Databunker Documentation

You can manage TLS certificates in three ways:

1. Helm-managed: Copy your certificate and key values directly into the ingress.secrets entry in your values.yaml.
2. External management: Create a TLS secret manually in Kubernetes (e.g., named databunker.service-tls).
3. Cert-manager: Use a tool like cert-manager to manage secrets automatically.

Certificate files must be PEM-encoded. Example formats:

Certificate:

-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----

Private Key:

-----BEGIN RSA PRIVATE KEY-----
...
-----END RSA PRIVATE KEY-----

The Shareable Record API allows you to create temporary, public records that reference internal objects (users, sessions, etc.). This is useful for sharing specific profile parts or session details with 3rd party systems or logs without requiring authentication for the recipient.

Note: Access to the record data is open to anyone who has the {record} token; no access token or password is required for retrieval.

The User App API allows you to store supplemental information (like shipping addresses) that is separate from the core user profile.

• Create/Overwrite: POST /v1/userapp/token/{token}/{appname}. Submitting multiple times for the same user and appname will overwrite the previous value.
• Update: PUT /v1/userapp/token/{token}/{appname}.
• Get specific app record: GET /v1/userapp/token/{token}/{appname}.
• Get all app records for a user: GET /v1/userapp/token/{token}.
• List all apps: GET /v1/userapps.

# Create a shipping record
curl -s http://localhost:3000/v1/userapp/token/$TOKEN/shipping \
  -H "X-Bunker-Token: $XTOKEN" -H "Content-Type: application/json" \
  -d '{"country":"UK","city":"London","address":"221B Baker Street","postcode":"12345","status":"new"}'

Databunker operates as a secure vault for sensitive personal data (PII/PHI/KYC). The workflow follows these steps:

1. Storage: You send sensitive data to Databunker via its API.
2. Tokenization: Databunker returns a UUID token. You store this token in your primary application database instead of the actual sensitive data.
3. Querying: When you need the data, you query Databunker using the token or secure, hash-based indexing.
4. Protection: This architecture ensures that even if your main database is compromised via SQL or GraphQL injection, the attacker only retrieves meaningless UUID tokens, not plaintext personal information.

The Session API is used to store and manage session-related PII (e.g., IP addresses, user agents, or mobile device info). Each session record has an expiration period; once expired, the record is automatically deleted.

• Create Session: POST /v1/session/{token,login,email,phone}/{identity}. You can provide an expiration parameter (e.g., "3d") to specify the TTL.
• Get specific session: GET /v1/session/session/:session.
• Get all sessions for a user: GET /v1/session/{token,login,email,phone}/{identity}. This endpoint supports pagination via offset and limit query parameters.

Before installing the Databunker Helm chart, ensure your environment meets the following requirements:

• Kubernetes: version 1.12 or higher
• Helm: version 1.12 or higher

Project admins can push the built container images to the registry. This includes pushing the specific version tag and optionally the latest tag.

docker login
VERSION=$(cat ./version.txt)
docker push securitybunker/databunker:$VERSION
# Optionally, push container with the latest tag
docker tag securitybunker/databunker:$VERSION securitybunker/databunker:latest
docker push securitybunker/databunker:latest

You can upgrade your Databunker deployment using Helm without losing access to encrypted records. The initial deployment creates a Kubernetes secret named databunker which contains the DATABUNKER_MASTERKEY (for record encryption) and the DATABUNKER_ROOTTOKEN (for service access). This secret is preserved during upgrades.

To upgrade, run helm upgrade with the same external database and certificate configurations used during the initial installation.

helm repo update
MYSQL_RDS_HOST=$(terraform output -raw rds_hostname)
helm upgrade databunker --set mariadb.enabled=false \
  --set externalDatabase.host=$MYSQL_RDS_HOST \
  --set externalDatabase.existingSecret=databunker-mysql-rds \
  --set certificates.customCertificate.certificateSecret=databunkertls

To deploy the Databunker DEMO using a NodePort service, use the following command. By default, the service will be accessible on port 30300. You can access the UI locally at http://localhost:30300/.

helm install demo databunker/databunker-demo --set service.type=NodePort

To use an image from a private registry, you must specify an imagePullSecrets configuration. Note that imagePullSecrets cannot be passed via the --set flag in Helm; it must be provided in a values.yaml file.

1. Manually create the image pull secret in your Kubernetes namespace.
2. Add the secret name to your values.yaml.

imagePullSecrets:
  - name: SECRET_NAME