Tessera DB Tutorial: Enable At-Rest Encryption for Connector Credentials

Encryption at rest is unlocked with a secret key you supply. Generate one with plenty of entropy from any tool you trust.

Give the running server the key when it boots, sourced from your secret manager rather than hard-coded anywhere. On startup Tessera logs that credentials and data are encrypted at rest, confirming the key was picked up.

Every secret-shaped field a connector stores — passwords, API keys, connection strings — is replaced on disk with authenticated ciphertext, each with its own unique nonce. The durable audit log and storage layers are covered under the same key. Because the reader auto-detects encrypted versus plaintext, you can turn this on without a data migration.

Restart the server with the same key. Sources load, credentials decrypt transparently, and polling resumes. Lose the key and the data is unrecoverable by design — Tessera will fail to load the affected source and log a clear error rather than silently continuing.

Don't bake the key into a script or image. Source it from your secret manager (Vault, AWS Secrets Manager, GCP Secret Manager) at process start. It only needs to exist in the running process's environment.