Encryption keys

Dopbase must keep the master encryption key outside the database that stores encrypted secrets.

dopbase.db
    +
master encryption key stored separately

This separation means that stealing the database alone should not reveal plaintext secret values.

Current key source

Dopbase 0.1.9 uses a 256-bit master key in a local owner-only file. Set its location in server.toml, with DOPBASE_MASTER_KEY_PATH, or with the --master-key-file option. Setup and automatic startup create a missing key when initializing an instance and preserve an existing key. Startup verifies the key before serving HTTP requests. Use the same key options for setup and startup.

External key managers remain roadmap work. Future providers may include:

• AWS KMS
• Google Cloud KMS
• Azure Key Vault
• A hardware security module

Only implemented and reviewed providers appear in the configuration reference.

Operator responsibilities

• Restrict access to key material to the Dopbase process and authorized operators.
• Keep key backups separate from database backups.
• Prevent keys from appearing in shell history, process arguments, logs, or support bundles.
• Plan rotation before the original key is compromised or retired.
• Test recovery with the same provider and access policy used in production.

The current release does not automate master-key rotation. Protect and back up the file separately from the SQLite database.