Skip to content

chore: hide private ssh key when on edit polydock store page#62

Open
dan2k3k4 wants to merge 3 commits intomainfrom
hide-ssh-key
Open

chore: hide private ssh key when on edit polydock store page#62
dan2k3k4 wants to merge 3 commits intomainfrom
hide-ssh-key

Conversation

@dan2k3k4
Copy link
Member

@dan2k3k4 dan2k3k4 commented Feb 4, 2026

Improves the security by moving the storage of the lagoon_deploy_private_key from a plain text column in the polydock_stores table to an encrypted value in the polydock_variables table

Changes:

  • Added 2026_02_05_133703_move_lagoon_deploy_private_key_to_variables.php to migrate existing keys to the polydock_variables table with encryption and drop the lagoon_deploy_private_key column from polydock_stores
  • Updated App\Models\PolydockStore to remove lagoon_deploy_private_key from $fillable
  • Added an accessor getLagoonDeployPrivateKeyAttribute to seamlessly retrieve the decrypted key from the variables relation, ensuring backward compatibility
  • Updated App\Console\Commands\CreateStore to store the private key using setPolydockVariableValue with encrypted => true
  • Updated CreatePolydockStore and EditPolydockStore pages to handle the lagoon_deploy_private_key field manually. The key is now intercepted during creation/update and stored securely via the variable helper, rather than being saved directly to the model.
  • Updated DatabaseSeeder, AmazeeTrialSeeder, and LocalstackSeeder to use the secure storage method for creating stores with deploy keys
  • Added getPublicKeyFromPrivateKey helper in LagoonHelper to support key derivation for display in the UI.

Security Implications:

  • The private SSH key used for Lagoon deployments is no longer stored in plain text in the main stores table.
  • It is now encrypted at rest using Laravel's Crypt facade within the polydock_variables table.

Backward Compatibility:

  • The getLagoonDeployPrivateKeyAttribute accessor ensures that any existing code accessing $store->lagoon_deploy_private_key continues to work without modification, automatically fetching and decrypting the value.

@dan2k3k4 dan2k3k4 requested review from bomoko and smlx February 5, 2026 14:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant