Spike: Secret Storage

Overview

Encrypted storage is needed by several apps e.g. for things like (RMAPI keys, SMTP credentials, FTP credentials, etc.). Currently these things are not encrypted at rest. Some have their own APIs (just to access/manage the sensitive data) with their own permissions, others are simply stored in mod-configuration

Specific Questions to be answered:

1. What technologies would be appropriate for this?
2. What might a solution look iike? Is there some abstraction layer/interface allowing for different implementations?
3. What's required for a module to store/retrieve a secret?
4. What's required on the infrastructure side?

Acceptance Criteria

• The questions above are answered
• One or more approach is documented on the wiki
  • If more than one approach is provided, pros & cons are provided along with a recommendation
• POC code (if applicable) is committed to git and linked to from the wiki page