does anyone know where there are some documentation on how to set up SpiceDB to use Postgres with client side coloum encryption using pgcrypto ?

👋I haven't seen this pop up before, maybe the other folks have. Are you thinking of encrypting the resource or subject IDs client-side? I don't think SpiceDB would be able to compute the results without the ability to decrypt those values, and I'm not sure if that would defeat whatever you were trying to achieve with column encryption. And if somehow you'd be ok with that, SpiceDB would have to reencrypt those values. Even the request payload to SpiceDB would have to be encrypted. I don't think this can work without some previous engineering.

also what's the use case? there isn't (or shouldn't be) PII or any other sensitive form of information in the SpiceDB store

The usecase is a litlle odd, Our vendor can supply a managed postgress DB, but not with sevrverside encryption, We on the other hand encrypt any storage at rest as a global policy, Hence only various client-side encryption is left. pgcrypto is the normal way to go about it, but it requires that the client ( here SpiceDB) can send the a key along in every call to pgencrypt which in turn will call postgress.

I see. If this is a matter of something we can configure in the

pgx

client, I don't see why it couldn't be supported. And if it was something that could be enabled by simply adding it as a parameter to the DSN, then it could even work out of the box. If the interpretation of "at rest" here is data persisted in disk, then there wouldn't be any need to also encrypt thigns on the SpiceDB side to adhere to your company policy, but please note that SpiceDB does keep data cached in memory, so I'm not sure if that could be in conflict with the policy.

At rest would only be the postgress DB on disk not the working mem of the spiceDB service. It seems that we need to test this to see if it could work out

as noted, if this is something that can be transparently handled by pgx, SpiceDB can probably support it out of the box or with minimal changes