Two-Tier Envelope Encryption (AES-256-CBC)
Credentials entered into the Web Console (Slack bot tokens, SMTP passwords, Twilio keys, OIDC client secrets) are encrypted before touching PostgreSQL. OpsKnight uses a two-tier Envelope Encryption model (V2):
- The master key is configured strictly through the
ENCRYPTION_KEYenvironment variable (never stored in the database). - Each secret is encrypted with a unique, dynamically generated Data Encryption Key (DEK).
- Ciphertext is stored as
v2:<dekIv>:<encryptedDek>:<payloadIv>:<encryptedPayload>.
Generate a 32-byte (256-bit) master encryption key:
bash
openssl rand -hex 32
Fields Encrypted at Rest in PostgreSQL
| Provider / Subsystem | Encrypted Field(s) | Purpose |
|---|---|---|
| Jira Cloud | apiToken, webhookSecret | Two-way issue synchronization |
| SSO / OIDC | clientSecret | OAuth2/OIDC client secrets |
| Slack ChatOps | botToken, signingSecret, clientSecret | War room bot & interactive actions |
| Twilio | authToken, whatsappAuthToken | SMS & WhatsApp paging keys |
| AWS SNS / SES | secretAccessKey | High-volume delivery credentials |
| Email (Resend / SendGrid / SMTP) | apiKey, password | Incident reports & status updates |
| Web Push | vapidPrivateKey | Browser push notification keys |
Inbound Webhook Verification & Anti-Replay
Every inbound monitoring integration route enforces cryptographic authentication before payloads reach incident business logic:
- Timing-Safe Equality: Secret tokens and signatures are evaluated using
crypto.timingSafeEqualwith dummy buffer evaluation on length mismatches to eliminate timing side-channel leaks. - Outbound Anti-Replay: Outbound notifications bind signatures to Unix timestamps (
X-OpsKnight-Timestamp+X-OpsKnight-Signature) with a strict 300-second expiration window.
Supported Inbound Signature Verifiers
| Provider | Signature Header | Algorithm |
|---|---|---|
| GitHub | x-hub-signature-256 | HMAC-SHA256 |
| Slack ChatOps | x-slack-signature | HMAC-SHA256 |
| Sentry | sentry-hook-signature | HMAC-SHA256 |
| Grafana | x-grafana-signature | HMAC-SHA256 |
| GitLab | x-gitlab-token | Constant-time token |
| Generic Webhooks | x-signature / x-webhook-signature | HMAC-SHA256 |
Identity, OIDC SSO & Role Governance
OpsKnight supports local accounts and OpenID Connect (OIDC) single sign-on with Google Workspace, Okta, Azure AD, Keycloak, and Authentik.
- Workspace Roles:
USER(scoped to assigned teams/services),RESPONDER(global response), andADMIN(system settings and user governance). - Team Roles: Independent team-level classification (
MEMBER,ADMIN,OWNER) with last-owner demotion protection. - Auto-Provisioning & Allowlisting: Restrict sign-in to verified corporate email domains.
VPC Network Isolation & Zero Telemetry
- Zero External Telemetry: No Google Analytics, no PostHog, no Sentry phone-home, no tracking pixels. All logs and audit trails remain in your PostgreSQL database.
- Database Isolation: Keep PostgreSQL (port 5432) on private internal container networks or VPC security groups.
- TLS Reverse Proxying: Always terminate TLS at Nginx, Caddy, or an Ingress Controller and forward
X-Forwarded-ProtoandX-Forwarded-Host. - Non-Root Containers: Container images run as unprivileged users, compatible with Kubernetes restricted pod security standards.
What this is not
There is no hosted SaaS cloud holding your encryption keys. If you lose your ENCRYPTION_KEY, encrypted secrets cannot be recovered. Always store backups of your environment secrets in a dedicated secrets manager (AWS Secrets Manager, HashiCorp Vault, GCP Secret Manager).