@tsmx/secure-config

@tsmx/secure-config

Secure multi-environment configurations with encrypted secrets.

Usage

1. Encrypt sensitive data in your JSON configuration file. For more details please see generating encrypted values and naming conventions.

   {
       "database": {
           "host": "127.0.0.1",
           "user": "ENCRYPTED|50ceed2f97223100fbdf842ecbd4541f|df9ed9002bfc956eb14b1d2f8d960a11",
           "pass": "ENCRYPTED|8fbf6ded36bcb15bd4734b3dc78f2890|7463b2ea8ed2c8d71272ac2e41761a35"
       }
   }
   

2. Use your configuration in the code.

   const conf = require('@tsmx/secure-config');
   
   function MyFunc() {
       let dbHost = conf.database.host; // = '127.0.0.1'
       let dbUser = conf.database.user; // = 'MySecretDbUser'
       let dbPass = conf.database.pass; // = 'MySecretDbPass'
       //...
   }
   

A fully working example project is also available on GitHub.

To get all information please also check out the full documentation.

Injecting the decryption key

The key for decrypting the encrypted values is derived from an environment variable named CONFIG_ENCRYPTION_KEY. You can set this variable whatever way is most suitable, e.g.

• set/export in the command line or in your bash pofile

  export CONFIG_ENCRYPTION_KEY=0123456789qwertzuiopasdfghjklyxc
  

• using an env block in your VS-Code launch configuration

  ...
  "env": {
      "CONFIG_ENCRYPTION_KEY": "0123456789qwertzuiopasdfghjklyxc"
  },
  ...
  

• using an env block in your deployment descriptor, e.g. app.yaml for Google App Engine

  env_variables:
    CONFIG_ENCRYPTION_KEY: "0123456789qwertzuiopasdfghjklyxc"
  

• for testing with Jest I recommend to create a test key and set it globally for all tests in the jest.config.js, e.g.

  process.env['CONFIG_ENCRYPTION_KEY'] = '0123456789qwertzuiopasdfghjklyxc';
  
  module.exports = {
      testEnvironment: 'node'
  };
  

• etc.

More examples are available in the full documentation.

The key length must be 32 bytes! The value set in CONFIG_ENCRYPTION_KEY has to be:

• a string of 32 characters length, or
• a hexadecimal value of 64 characters length (= 32 bytes)

Otherwise an error will be thrown.

Examples of valid key strings:

• 32 byte string: MySecretConfigurationKey-123$%&/
• 32 byte hex value: 9af7d400be4705147dc724db25bfd2513aa11d6013d7bf7bdb2bfe050593bd0f

Different keys for each configuration environment are strongly recommended.

Generating encrypted entries

Option 1: secure-config-tool

For better convenience I provided a very basic secure-config-tool to easily generate the encrypted entries.

Option 2: NodeJS crypto functions

You can simply use crypto functions from NodeJS with the following snippet to create the encrypted entries:

const crypto = require('crypto');
const algorithm = 'aes-256-cbc';

function encrypt(value) {
    let iv = crypto.randomBytes(16);
    let key = Buffer.from('YOUR_KEY_HERE');
    let cipher = crypto.createCipheriv(algorithm, key, iv);
    let encrypted = cipher.update(value);
    encrypted = Buffer.concat([encrypted, cipher.final()]);
    return 'ENCRYPTED|' + iv.toString('hex') + '|' + encrypted.toString('hex');
}

Remarks

The generated encrypted entry must always have the form: ENCRYPTED | IV | DATA.

Part	Description
ENCRYPTED	The prefix ENCRYPTED used to identify configuration values that must be decrypted.
IV	The ciphers initialization vector (IV) that was used for encryption. Hexadecimal value.
DATA	The AES-256-CBC encrypted value. Hexadecimal value.

Naming conventions

You can have multiple configuration files for different environments or stages. They are distinguished by the environment variable NODE_ENV. The basic configuration file name is config.json if this variable is not present. If it is present, a configuration file with the name config-[NODE_ENV].json is used. An exception will be thrown if no configuration file is found.

All configuration files must be located in a conf/ directory of the current running app, meaning a direct subdirectory of the current working directory (CWD/conf/).

Example structure

• Development stage
  • NODE_ENV: not set
  • Configuration file: conf/config.json
• Prodcution stage
  • NODE_ENV: production
  • Configuration file: conf/config-production.json
• Test stage, e.g. for Jest
  • NODE_ENV: test
  • Configuration file: conf/config-test.json

path-to-your-app/
├── conf/
│   ├── config.json
│   ├── config-production.json
│   └── config-test.json
├── app.js
└── package.json

Test

npm install
npm test