Secrets management

Proper secrets management is critical for securing your Rafiki deployment. This section covers all types of secrets used in the architecture.

Note

You should generate and prepare all secrets before beginning infrastructure deployment.

Types of secrets

Database credentials

Database credentials are used by all services to connect to PostgreSQL and Redis instances.

Secret Type	Usage
PostgreSQL Admin	Database administration
PostgreSQL Service	Application connections
Redis Password	Cache connections

Application Secrets

Application-specific secrets used by Rafiki services for encryption and authentication.

Secret Type	Usage
COOKIE_KEY	Session cookie encryption
AUTH_SERVER_SECRET	JWT token signing
WEBHOOK_SECRET	Webhook signature validation
PRIVATE_KEY_FILE	ILP packet signing

TLS certificates

TLS certificates for securing communications between services and external clients.

Certificate Type	Usage
Let’s Encrypt	Public HTTPS endpoints
Internal CA	Service-to-service

External service credentials

Credentials for connecting to external services and APIs.

Credential Type	Usage
GCP Service Account	Google Cloud APIs
Container Registry	Image pulls
Monitoring APIs	Metrics and alerting

Best practices

• Generate strong secrets: Use cryptographically secure methods to generate secrets
• Secure Kubernetes namespaces: Create Kubernetes secrets for each namespace
• Use a secrets manager: For enhanced security, store secrets in Google Cloud Secrets Manager or Hashicorp Vault
• Rotate secrets on a regular basis: Automate secret rotations with CronJobs

Next steps

With your secrets securely generated and managed:

1. Secure storage: Store your generated secrets in a secure location (not in Git!)
2. Setup infrastructure: Deploy GCP infrastructure using Terraform - you’ll need these secrets during the deployment process
3. Deploy services: Configure and deploy Rafiki and wallet services using your pre-generated secrets

Proper secrets management is foundational to a secure Rafiki deployment. Regular rotation, secure storage, and comprehensive monitoring ensure your payment infrastructure remains protected.