Add age encryption support for database backups

[namolnad]

Summary

Adds support for age encryption to encrypt Litestream database backups at rest. This introduces two new configuration options:
age_recipient (public key) and age_secret_key (identity/private key).

Changes

Core Configuration

• Added age_recipient and age_secret_key to Litestream::Configuration
• Added module-level accessors matching the pattern of other replica configuration options
• Environment variables LITESTREAM_AGE_RECIPIENT and LITESTREAM_AGE_SECRET_KEY are now set in the prepare method for all commands

Rake Tasks

• Updated litestream:env task to output the new age encryption variables

Generator Templates

• Config template: Added commented age: section with recipients: and identities: fields following the Litestream age encryption format
• Initializer template: Added documentation for configuring age encryption credentials via Rails encrypted credentials

Testing

• Updated teardown to clear age environment variables
• Added individual tests for age_recipient and age_secret_key for all commands (replicate, restore, databases, generations, snapshots, wal)
• Updated comprehensive tests to verify age variables are set alongside other replica configuration
• Updated litestream:env task test expectations

Usage

Users can configure age encryption in their config/initializers/litestream.rb:

Rails.application.configure do
  config.litestream.age_recipient = Rails.application.credentials.litestream&.age_recipient
  config.litestream.age_secret_key = Rails.application.credentials.litestream&.age_secret_key
end

Then uncomment the age: section in config/litestream.yml:

age:
  recipients:
    - $LITESTREAM_AGE_RECIPIENT
  identities:
    - $LITESTREAM_AGE_SECRET_KEY

The environment variables will be automatically set when running Litestream commands through the gem.

[alxvernier]

FYI the age encryption is disabled in Litestream v 0.5.x

[namolnad]

Appreciate the proactive heads up @alxvernier. I had seen that, but saw at the time of submission, this was (I think still is) built with a version that has age encryption support (which, if encryption is needed, is recommended as the version to stay with). As I need encryption and monkeypatched this for myself, I thought others might benefit from this until it is not supported by the underlying litestream version.

[fractaledmind]

Thank you for this, and sorry it sat so long. I'm closing it because the gem is moving to Litestream 0.5 in the next release (#78), and 0.5 dropped age encryption, so these settings would have nothing to configure.

If you need encrypted backups, stay on litestream-ruby 0.15.x, the last release bundling Litestream 0.3, which still supports age. If Litestream brings encryption back in a later release, I'd welcome a PR for it.

🤖 Generated with Claude Code