René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"[llm-config] how to encrypt a per-user API key at rest, with no new infrastructure","articleBody":"## Question\n\nHow should a per-user API key be encrypted at rest, in this stack, with no new infrastructure?\n\nSettled: app-level envelope encryption, AES-256-GCM, master key supplied via env, ciphertext in Postgres. Not KMS, not `pgcrypto`. Nothing in this repo does crypto today — `tooling/secrets-sync` is dev-env plumbing, not a runtime primitive.\n\nFind:\n\n- **Node's built-in `crypto` versus a library.** Whether `node:crypto` covers AES-256-GCM envelope encryption cleanly enough to avoid a dependency, and what a maintained library buys. The repo prefers standard libraries over custom solutions, so the bar for hand-rolling is high — but so is the bar for taking a dependency on crypto code.\n- **Envelope structure.** Master key → data key → ciphertext, versus encrypting directly under a key derived from the master. What each costs at rotation time.\n- **The stored value.** One `bytea`/`text` column or several (ciphertext, IV, auth tag, key version). What a key-version field buys before rotation is specified.\n- **Master key handling.** Format and length, how it arrives through `@acme/env` as a secret with no profile value, and what happens on a run that has no key — the repo's `secretsOnly` pattern relaxes secrets on runs that cannot supply one, which must not silently disable encryption.\n- **Tests.** Backend suites self-provision containers and never mock env (ADR 0014). How a test gets a real master key without one being committed.\n- **Runtime portability.** Must work under Node on Next.js and under Nitro for the TanStack apps. Flag anything Web Crypto-only or Node-only that would break one of them.\n\nPrimary sources: Node docs, the library's own docs, OWASP guidance on key storage. Post the findings as a comment on this ticket and close it.\n","author":{"url":"https://github.com/regybean","@type":"Person","name":"regybean"},"datePublished":"2026-09-24T15:16:50Z","url":"https://github.com/regybean/Trellis/issues/438"}