In addition to encrypted presets, we could give the option to the user to have the main account private not in the presets at all. Bootstrap will prompt for the private key anytime it's required. It may add a level of security but it complicates the deployment especially in automatic environments. The user would need to provide a private key instead of a password to decrypt a preset.
I would add a preset property:
privateKeySecurityMode:
ENCRYPT: current option, keys are encrypted in the generated adresses.yml
PROMPT_MAIN: The main private key is never stored in the encrypted addreses.yml (only public key). Boostrap will prompt when required.
PROMPT_ALL: No private key is stored in the encrypted addresses.yml (Only public keys). Bootstrap will prompt when required on config/start/link and --upgrade
fboucquez
commented
3 years ago
In addition to encrypted presets, we could give the option to the user to have the main account private not in the presets at all. Bootstrap will prompt for the private key anytime it's required. It may add a level of security but it complicates the deployment especially in automatic environments. The user would need to provide a private key instead of a password to decrypt a preset.
I would add a preset property:
privateKeySecurityMode: