How It Works

1. Legion::Crypt includes the Cipher module

2. Legion::Crypt includes the vault module if crypt.vault.enabled is true

3. The first time Legion::Crypt.encrypt/decrypt is called, it will check to see if it has the cluster secret or figure it out in this order

   1. It first checks to see if it is in Vault. This makes it safe for all nodes to go offline

   2. It will check if any other nodes are online. If there aren’t it will generate a new CS

   3. If there are consumers, it will send a message out with it’s public key asking for the cluster secret

   4. It will then verify the message by looking to unencrypt the test string against the validation_string

Settings