Encrypted front door
Every way into the vault passes through a single encrypted entrance.
The vault's internal services accept no connections from outside the
deployment, and no address anywhere in the vault ever carries a secret —
credentials travel only inside requests, never in a URL.
A visitor reaches the vault only through the encrypted entrancestack
- Given a running vault deployment
- When a visitor connects to the vault's public address
- Then the connection is encrypted
- And the vault answers
An unencrypted request is turned awaystack
- Given a running vault deployment
- When a visitor sends an unencrypted request to the public address
- Then the vault does not serve it
The vault's internal service cannot be reached from outsidestack
- Given a running vault deployment
- When someone tries to connect straight to the vault's internal service
- Then the connection is refused
No address in the vault ever carries a secret
- Given the vault's complete catalog of routes
- Then no route accepts a credential as part of its address