festung: Remote multi-db SQLCipher server

This is a package candidate release! Here you can preview how this package release will appear once published to the main package index (which can be accomplished via the 'maintain' link below). Please note that once a package has been published to the main package index it cannot be undone! Please consult the package uploading documentation for more information.

[maintain] [Publish]

festung is a server that provides an HTTP API to execute queries against encrypted SQLite databases.

[Skip to Readme]


Change log None available
Dependencies aeson, argparser, async, base (>=4.9 && <5.0), base64-bytestring, bytestring, case-insensitive, containers, directory, either (<5), exceptions, festung, filepath, http-types, mtl, scientific, sqlcipher, text, transformers, unordered-containers, utf8-string, vector, wai, yesod, yesod-core [details]
License MIT
Author Figo GmbH
Maintainer developer@figo.io
Category Concurrency
Home page http://www.figo.io
Uploaded by figo at 2018-06-28T21:18:15Z



Maintainer's Corner

For package maintainers and hackage trustees

Readme for festung-

[back to package description]


Remote multi-db SQLCipher server exposing a REST API


The festung container is built with the help of an auxiliary container called steinmetz. The steinmetz container gathers and compiles all build dependencies, so that build process of festung itself is faster. You can build both containers by invoking make with no target.

$ make


To spin up a festung instance do

$ docker run --rm --tty --interactive --publish --name festung festung

or just do

$ make start

If you want to persist the vaults between multiple runs, you either have to mount a directory from the host system or create a docker volume. The latter could be done by doing

$ docker volume create vaults

and then run festung like so

$ docker run --rm -it -p --mount source=vaults,target=/var/festung --name festung festung


Once you have a festung instance running you can interact with the API by using curl, httpie or an HTTP client of your choice.

The databases that are handled by festung are encrypted. The key is provided through the Authorization header whose value is base64 encoded

$ echo foo | base64

The request body for issuing queries against festung contains the fields sql and params. To create a new table foo in the database 1 (encrypted with the password "foo") you can issue the following request:

# http localhost:2728/1 Authorization:Zm9vCg== sql='CREATE TABLE foo (id INT, b VARCHAR)' params:='[]'
    "data": [],
    "headers": [],
    "last_row_id": 0,
    "rows_changed": 0

The params paramter can be used for parametrizing queries. Let's say we insterted some data in our table

# http localhost:2728/1 Authorization:Zm9vCg== sql='INSERT INTO foo VALUES (1, "b")' params:='[]'
    "data": [],
    "headers": [],
    "last_row_id": 0,
    "rows_changed": 0

then we could use params as follows:

# http localhost:2728/1 Authorization:Zm9vCg== sql='SELECT * FROM foo WHERE id IN (?)' params:='[1]'
    "data": [
    "headers": [
            "name": "id",
            "type": "INT"
            "name": "b",
            "type": "VARCHAR"
    "last_row_id": 0,
    "rows_changed": -1