festung: Remote multi-db SQLCipher server

[ concurrency, library, mit, program ] [ Propose Tags ]

festung is a server that provides an HTTP API to execute queries against encrypted SQLite databases.

[Skip to Readme]
Dependencies aeson, argparser, async, base (>=4.9 && <5.0), base64-bytestring, bytestring, case-insensitive, containers, directory, either (<5), exceptions, festung, filepath, http-types, mtl, scientific, sqlcipher, text, transformers, unordered-containers, utf8-string, vector, wai, yesod, yesod-core [details]
License MIT
Author figo GmbH
Maintainer developer@figo.io
Category Concurrency
Home page http://www.figo.io
Uploaded by figo at Thu Jun 28 21:39:37 UTC 2018
Distributions NixOS:
Executables festung
Downloads 165 total (34 in the last 30 days)
Rating (no votes yet) [estimated by rule of succession]
Your Rating
  • λ
  • λ
  • λ
Status Hackage Matrix CI
Docs not available [build log]
All reported builds failed as of 2018-06-28 [all 3 reports]


  • Festung
    • Concurrency
      • Festung.Concurrency.Gig
      • Festung.Concurrency.Job
      • Festung.Concurrency.Utils
    • Festung.Config
    • Festung.Frontend
      • Festung.Frontend.Converters
      • Festung.Frontend.Validators
    • Festung.Utils
    • Festung.Vault
      • Festung.Vault.Persistence
      • Festung.Vault.VaultHandler
      • Festung.Vault.VaultManager


Maintainer's Corner

For package maintainers and hackage trustees

Readme for festung-

[back to package description]


Remote multi-db SQLCipher server exposing a REST API


The festung container is built with the help of an auxiliary container called steinmetz. The steinmetz container gathers and compiles all build dependencies, so that build process of festung itself is faster. You can build both containers by invoking make with no target.

$ make


To spin up a festung instance do

$ docker run --rm --tty --interactive --publish --name festung festung

or just do

$ make start

If you want to persist the vaults between multiple runs, you either have to mount a directory from the host system or create a docker volume. The latter could be done by doing

$ docker volume create vaults

and then run festung like so

$ docker run --rm -it -p --mount source=vaults,target=/var/festung --name festung festung


Once you have a festung instance running you can interact with the API by using curl, httpie or an HTTP client of your choice.

The databases that are handled by festung are encrypted. The key is provided through the Authorization header whose value is base64 encoded

$ echo foo | base64

The request body for issuing queries against festung contains the fields sql and params. To create a new table foo in the database 1 (encrypted with the password "foo") you can issue the following request:

# http localhost:2728/1 Authorization:Zm9vCg== sql='CREATE TABLE foo (id INT, b VARCHAR)' params:='[]'
    "data": [],
    "headers": [],
    "last_row_id": 0,
    "rows_changed": 0

The params paramter can be used for parametrizing queries. Let's say we insterted some data in our table

# http localhost:2728/1 Authorization:Zm9vCg== sql='INSERT INTO foo VALUES (1, "b")' params:='[]'
    "data": [],
    "headers": [],
    "last_row_id": 0,
    "rows_changed": 0

then we could use params as follows:

# http localhost:2728/1 Authorization:Zm9vCg== sql='SELECT * FROM foo WHERE id IN (?)' params:='[1]'
    "data": [
    "headers": [
            "name": "id",
            "type": "INT"
            "name": "b",
            "type": "VARCHAR"
    "last_row_id": 0,
    "rows_changed": -1