Remove decrypt key by default

Signed-off-by: Bryan Frimin <bryan@getprobo.com>
2025-10-02 00:32:48 +02:00
parent 17ea259d8d
commit a2485ec6fa
6 changed files with 94 additions and 107 deletions
--- a/pkg/certmanager/renewer.go
+++ b/pkg/certmanager/renewer.go
@@ -182,7 +182,9 @@ func (r *Renewer) renewDomain(ctx context.Context, conn pg.Conn, domain *coredat
 	)

 	lockedDomain.SSLCertificatePEM = cert.CertPEM
-	lockedDomain.SSLPrivateKeyPEM = cert.KeyPEM
+	if err := lockedDomain.EncryptPrivateKey(cert.KeyPEM, r.encryptionKey); err != nil {
+		return fmt.Errorf("cannot encrypt private key: %w", err)
+	}
 	chainStr := string(cert.ChainPEM)
 	lockedDomain.SSLCertificateChain = &chainStr
 	lockedDomain.SSLExpiresAt = &cert.ExpiresAt