Encryption and TLS

At rest#

• Secrets are encrypted at rest with the platform master key and delivered to containers through the vault-lite path — never stored as plain rows.
• Template and provider credentials follow the same rule: encrypted, and only decrypted in the process that needs them.
• SSH private keys are AES-256 encrypted with the master key.
• Backup repositories are restic-encrypted before anything leaves the node.

In transit and at the edge#

• Traefik terminates HTTPS with automatic Let's Encrypt certificates; custom certificates can override the default for specific domains (see Domains and SSL).
• Agent ↔ control plane traffic runs over the NATS transport with its own TLS certificates, rotated by the repair tool.
• The router is default-deny: nothing is exposed publicly until you add a domain to a service.

The platform's own key#

Activation uses an Ed25519 identity that never leaves your server — leases are signed to your instance, not to the vendor (see Licensing and Activation).