GantryCD
Secret encryption
Every sensitive value GantryCD persists is encrypted before it reaches Postgres — OIDC client secrets, PKCE verifiers, SCM auth configs, secret environment variables, and github-actions signing keys. Encryption is mandatory: the backend runs a self-test at boot and aborts if it can’t encrypt and decrypt.
| Provider | Content cipher | Key source |
|---|---|---|
| AES-256 | AES-256-GCM | a 32-byte key held in the process |
| AWS KMS | AES-256-GCM | a per-secret data key wrapped by an AWS KMS CMK |
You select one with GANTRYCD_DATA_ENCRYPTION_PROVIDER. A process runs a single
provider at a time.
Self-describing envelope
Every ciphertext begins with a one-byte scheme identifier, so GantryCD can tell which provider produced a value from the bytes alone — the foundation for future re-encryption tooling. New providers claim a new byte (never reuse one).
[ scheme (1 byte) ] [ scheme-specific body ]AAD binding
Each row’s stable identifier is bound as additional authenticated data, so a ciphertext copied to a different row fails to decrypt. The boot self-test asserts this binding holds.
Internals
The envelope layout, the SecretCipher interface, key rotation notes, and how to
add a provider are in
Data-at-rest encryption.