opensource/coder
3
0
Fork 0
mirror of https://github.com/coder/coder.git synced 2026-09-24 15:04:27 +08:00
Code Issues Packages Projects Releases Wiki Activity

docs: note Database Encryption coverage for user secrets (#26435)

Browse Source
This commit is contained in:
Zach
2026-06-17 14:52:07 -06:00
committed by GitHub
parent e188ee03a4
commit 2f0bb657e2
3 changed files with 17 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/admin/security/database-encryption.md
+4 -3
View File
@@ -1,8 +1,9 @@
# Database Encryption
By default, Coder stores external user tokens in plaintext in the database.
Database Encryption allows Coder administrators to encrypt these tokens at-rest,
preventing attackers with database access from using them to impersonate users.
By default, Coder stores external user tokens and other sensitive values in
plaintext in the database. Database Encryption allows Coder administrators to
encrypt these values at-rest, preventing attackers with database access from
reading or misusing them.
## How it works
docs/admin/security/secrets.md
+3 -1
View File
@@ -49,7 +49,9 @@ Users can view their public key in their account settings:
User secrets are developer-managed values that Coder injects at workspace start.
If a user secret targets the same environment variable name or file path as a
template-provided variable or file, Coder injects the user secret into that
workspace. See the [User secrets guide](../../user-guides/user-secrets.md).
workspace. User secret values are covered by
[Database Encryption](./database-encryption.md) when it is enabled. See the
[User secrets guide](../../user-guides/user-secrets.md).
## Dynamic Secrets
docs/user-guides/user-secrets.md
+10 -2
View File
@@ -29,6 +29,13 @@ create or update them.
> that workspace. Do not share a workspace that has injected secrets with users
> who should not access those values.
### Storage and encryption
Coder stores user secret values in the database. When
[database encryption](../admin/security/database-encryption.md) is enabled,
Coder encrypts secret values at rest. Otherwise, values are stored in plaintext
in the database.
## How your secrets reach a workspace
Coder applies your secrets when your workspace starts. The same applies any
@@ -103,8 +110,9 @@ the env aggregate could never be injected successfully as an environment
variable.
These caps measure stored bytes, which is what Coder writes to the database.
In deployments with secret encryption enabled, stored bytes exceed the raw
value.
In deployments with
[database encryption](../admin/security/database-encryption.md) enabled,
stored bytes exceed the raw value.
## Manage secrets from the dashboard