diff options
Diffstat (limited to 'doc/book/cookbook/encryption.md')
| -rw-r--r-- | doc/book/cookbook/encryption.md | 17 |
1 files changed, 10 insertions, 7 deletions
diff --git a/doc/book/cookbook/encryption.md b/doc/book/cookbook/encryption.md index 156c54e8..8d45a0ee 100644 --- a/doc/book/cookbook/encryption.md +++ b/doc/book/cookbook/encryption.md @@ -49,14 +49,9 @@ implements a protocol that has been clearly reviewed, Secure ScuttleButt's Secret Handshake protocol. This is why setting a `rpc_secret` is mandatory, and that's also why your nodes have super long identifiers. -## Encrypting traffic between a Garage node and your client +## HTTP API endpoints provided by Garage are in clear text -HTTP API endpoints provided by Garage are in clear text. -You have multiple options to have encryption between your client and a node: - - - Setup a reverse proxy with TLS / ACME / Let's encrypt - - Setup a Garage gateway locally, and only contact the garage daemon on `localhost` - - Only contact your Garage daemon over a secure, encrypted overlay network such as Wireguard +Adding TLS support built into Garage is not currently planned. ## Garage stores data in plain text on the filesystem @@ -76,6 +71,14 @@ system such as Hashicorp Vault? # Adding data encryption using external tools +## Encrypting traffic between a Garage node and your client + +You have multiple options to have encryption between your client and a node: + + - Setup a reverse proxy with TLS / ACME / Let's encrypt + - Setup a Garage gateway locally, and only contact the garage daemon on `localhost` + - Only contact your Garage daemon over a secure, encrypted overlay network such as Wireguard + ## Encrypting data at rest Protects against the following threats: |