Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Add AES-256-GCM encryption for environment variables in .env files with Admin UI integration #617

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Draft
Copilot wants to merge 5 commits into
base: main
Choose a base branch
from
Draft

Add AES-256-GCM encryption for environment variables in .env files with Admin UI integration #617

Copilot wants to merge 5 commits into from

Conversation

Copy link
Contributor

Copilot AI commented Dec 17, 2025 •
edited
Loading

Storing LDAP passwords, API keys, and other credentials in plain text in .env files is a security risk. This PR adds transparent encryption support using AES-256-GCM, leveraging the existing TokenStorageService to eliminate code duplication and providing both CLI and Admin UI options for encrypting values.

Implementation

CLI encryption tool (server/utils/encryptEnvValue.js)

  • Encrypts values using TOKEN_ENCRYPTION_KEY from environment
  • Uses existing TokenStorageService for consistency
  • Outputs format: ENC[AES256_GCM,data:...,iv:...,tag:...,type:str]
  • Fails fast in production if encryption key not set

Automatic decryption (server/envDecryptor.js)

  • Imports early in config.js before any other modules
  • Uses TokenStorageService for decryption (no code duplication)
  • Detects and decrypts ENC[...] values at startup
  • Silent in production, verbose in development
  • Continues on decryption failure with clear error reporting

Admin UI Integration (NEW)

  • Added /api/admin/auth/encrypt-value endpoint
  • Allows users to submit plaintext and receive encrypted value via API
  • Can be integrated into admin UI for point-and-click encryption
  • Same encryption method used for model API keys

Documentation

  • Complete guide in docs/encryption.md
  • Updated LDAP auth and security docs
  • Examples in config.env and .env.example
  • Documented admin UI endpoint usage

Usage

Option 1: CLI Tool

# Encrypt a password
$ node server/utils/encryptEnvValue.js "my-ldap-password"
ENC[AES256_GCM,data:abc...,iv:def...,tag:ghi...,type:str]

Option 2: Admin UI API

# Via API endpoint
curl -X POST /api/admin/auth/encrypt-value \
  -H "Content-Type: application/json" \
  -d '{"plaintext": "my-ldap-password"}'

Use in .env

# Add to .env
LDAP_ADMIN_PASSWORD=ENC[AES256_GCM,data:abc...,iv:def...,tag:ghi...,type:str]
AD_BIND_PASSWORD=ENC[AES256_GCM,data:jkl...,iv:mno...,tag:pqr...,type:str]

# Application decrypts automatically on startup
$ npm start
🔓 Decrypted environment variable: LDAP_ADMIN_PASSWORD
🔓 Decrypted environment variable: AD_BIND_PASSWORD

Key Points

  • AES-256-GCM with unique IV per encryption and authentication tags
  • Uses existing TokenStorageService - no code duplication
  • Same encryption for model API keys and environment variables
  • Both CLI and Admin UI options for encrypting values
  • Backward compatible: plain text values continue to work
  • No application code changes required
  • Encryption key must be set explicitly in production (32-byte hex)

Architecture

All encryption now uses the same TokenStorageService:

  • Model API Keys (existing) ✅
  • OAuth Tokens (existing) ✅
  • Environment Variables (new) ✅

This ensures consistency, eliminates duplicate code, and provides a single source of truth for encryption across the application.

Original prompt

This section details on the original issue you should resolve

<issue_title>Credentials in .env should be encrypted</issue_title>
<issue_description>When configuring keys for models or LDAP configuration, following the documentation from https://github.com/intrafind/ihub-apps/blob/8e2f604b2eb3cc62b3239fdee1fce0d8ce6a8db3/docs/ldap-ntlm-authentication.md#environment-variables
It is stated that we should put the password in the .env file:

# For generic LDAP
LDAP_ADMIN_PASSWORD=your_ldap_admin_password

# For Active Directory
AD_BIND_USER=your_ad_service_account
AD_BIND_PASSWORD=your_ad_service_password

It is not secure to store passwords and credentials in plain text. iHub should have a way to either encrypt passwords or read encrypted passwords generated using the Encrypt password tool in the Admin UI</issue_description>

Comments on the Issue (you are @copilot in this section)

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

Copilot AI and others added 3 commits December 17, 2025 21:00
@manzke
Implement environment variable encryption for credentials
743666f 
- Created CLI tool (encryptEnvValue.js) to encrypt passwords and API keys
- Added envDecryptor.js for automatic decryption on application startup
- Updated config.js to load and decrypt environment variables early
- Updated documentation (LDAP auth guide, security.md, config files)
- Added encryption examples and best practices to config.env and .env.example
- Tested encryption/decryption cycle successfully

Co-authored-by: manzke <[email protected]>
@manzke
Address code review feedback for encryption feature
af92d2c 
- Make encryptEnvValue.js examples more generic (not just LDAP)
- Add production check - fail fast if TOKEN_ENCRYPTION_KEY not set
- Warn about random key generation causing decryption failures
- Provide better error summary when decryption fails
- Fix JavaScript syntax error in encryption.md documentation
- Add encryption.md comprehensive documentation

Co-authored-by: manzke <[email protected]>
@manzke
Final improvements to encryption feature based on code review
e3293c9 
- Enhanced security warnings for generated keys in development
- Made decryption logging less verbose in production
- Extracted regex patterns as constants for maintainability
- Reduced credential exposure in test output (use asterisks)
- Fixed documentation shell command examples
- Clarified limitations about manual encryption requirement
- Used generic placeholders in batch script example

Co-authored-by: manzke <[email protected]>
Copilot AI changed the title [WIP] Add encryption for credentials in .env file Add AES-256-GCM encryption for environment variables in .env files Dec 17, 2025
Copilot AI requested a review from manzke December 17, 2025 21:14
manzke
manzke requested changes Dec 17, 2025
View reviewed changes
Copy link
Contributor

@manzke manzke left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It feels like a lot of duplicate code.
Please review our codebase carefully and make sure we are not repeating ourselves. (Especially the encrypt decrypt part)
We should also check how keys in the admin ui are stored, when a user uses the Ui to configure ldap, ntlm or odic.
We should have a way to generate an encrypted key, so a user can copy and paste it. (User submits plaintext and receives an encrypted key)

@manzke
Refactor to use existing TokenStorageService and add admin UI endpoint
560e0db 
- Remove duplicate encryption code from envDecryptor.js
- Use TokenStorageService.encryptString/decryptString for consistency
- Update encryptEnvValue.js CLI tool to use TokenStorageService
- Add /api/admin/auth/encrypt-value endpoint for UI integration
- Update documentation to explain admin UI integration
- Ensure same encryption across model API keys and env variables

Co-authored-by: manzke <[email protected]>
Copy link
Contributor Author

Copilot AI commented Dec 17, 2025

It feels like a lot of duplicate code.
Please review our codebase carefully and make sure we are not repeating ourselves. (Especially the encrypt decrypt part)
We should also check how keys in the adm...

Refactored to eliminate code duplication in commit 560e0db:

Changes made:

  • Removed duplicate encryption logic from envDecryptor.js - now uses existing TokenStorageService
  • Updated encryptEnvValue.js CLI tool to use TokenStorageService.encryptString()
  • Added /api/admin/auth/encrypt-value endpoint for UI integration
  • All encryption now uses the same service that handles model API keys

Admin UI integration:
Users can now encrypt values through the admin UI by calling the new endpoint. The encrypted value (in ENC[...] format) can be copied and pasted into .env files.

Consistency:

  • LDAP/NTLM/OIDC configurations stored through the UI already use TokenStorageService
  • Environment variables now use the same encryption
  • No code duplication - single source of truth for encryption

Copilot AI changed the title Add AES-256-GCM encryption for environment variables in .env files Add AES-256-GCM encryption for environment variables in .env files with Admin UI integration Dec 17, 2025
Copilot AI requested a review from manzke December 17, 2025 21:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@manzke manzke Awaiting requested review from manzke

Requested changes must be addressed to merge this pull request.

Assignees

@manzke manzke

Copilot code review Copilot

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Credentials in .env should be encrypted

2 participants

@manzke