From ca44039cbb7f26a07b2354d49678dcec81679c2e Mon Sep 17 00:00:00 2001 From: pramodkumarka-sys Date: Wed, 16 Sep 2026 11:38:34 +0530 Subject: [PATCH 1/2] implementencrytpatrest --- .../learn/pages/clusters-and-availability/xdcr-overview.adoc | 4 ++++ .../pages/security/native-encryption-at-rest-overview.adoc | 3 +++ 2 files changed, 7 insertions(+) diff --git a/modules/learn/pages/clusters-and-availability/xdcr-overview.adoc b/modules/learn/pages/clusters-and-availability/xdcr-overview.adoc index fc26f92bfb..70bde35f79 100644 --- a/modules/learn/pages/clusters-and-availability/xdcr-overview.adoc +++ b/modules/learn/pages/clusters-and-availability/xdcr-overview.adoc @@ -250,6 +250,10 @@ Before attempting to enable half-secure replications, see the important informat For step-by-step procedures, see xref:manage:manage-xdcr/secure-xdcr-replication.adoc[Secure a Replication]. +In addition to the connection security described above, Couchbase Server's native encryption at rest also protects XDCR's persisted data. +When the administrator enables Configuration Encryption, Couchbase Server automatically encrypts XDCR metadata — including remote-cluster references, replication specifications, checkpoints, and collection mappings. +When the administrator enables Logs Encryption, Couchbase Server also encrypts the XDCR log file (goxdcr.log). XDCR requires no separate configuration. For more information, see xref:security/native-encryption-at-rest-overview.adoc#encrypting-audit-logs-and-configuration-data[Native Encryption at Rest]. + [#xdcr-advanced-settings] == XDCR Advanced Settings diff --git a/modules/learn/pages/security/native-encryption-at-rest-overview.adoc b/modules/learn/pages/security/native-encryption-at-rest-overview.adoc index c35357e780..53df9ecae8 100644 --- a/modules/learn/pages/security/native-encryption-at-rest-overview.adoc +++ b/modules/learn/pages/security/native-encryption-at-rest-overview.adoc @@ -94,6 +94,9 @@ This includes: * Logs of some services are not encrypted by NS Server. For example, Analytics log files such as `analytics_debug.log` and `analytics_periodic_dump.log` remain unencrypted even when encryption-at-rest for logs is enabled. + +* Couchbase Server stores most XDCR metadata — remote cluster references and replication specifications — using the same mechanism as other configuration data. When you enable encryption for configuration data, Couchbase Server also encrypts this XDCR metadata. +XDCR checkpoints, collection manifests, and broken maps use a separate storage mechanism (simple_store). Couchbase Server treats XDCR's log file (goxdcr.log) like other log files, and encrypts it when you enable encryption for logs. ==== [#when-data-is-encrypted] From dc02f717a159eb99fa40d257455c464bf0e21c2c Mon Sep 17 00:00:00 2001 From: pramodkumarka-sys Date: Fri, 18 Sep 2026 20:30:11 +0530 Subject: [PATCH 2/2] Updating review comment --- .../pages/security/native-encryption-at-rest-overview.adoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/learn/pages/security/native-encryption-at-rest-overview.adoc b/modules/learn/pages/security/native-encryption-at-rest-overview.adoc index 53df9ecae8..80fa217301 100644 --- a/modules/learn/pages/security/native-encryption-at-rest-overview.adoc +++ b/modules/learn/pages/security/native-encryption-at-rest-overview.adoc @@ -96,7 +96,7 @@ This includes: For example, Analytics log files such as `analytics_debug.log` and `analytics_periodic_dump.log` remain unencrypted even when encryption-at-rest for logs is enabled. * Couchbase Server stores most XDCR metadata — remote cluster references and replication specifications — using the same mechanism as other configuration data. When you enable encryption for configuration data, Couchbase Server also encrypts this XDCR metadata. -XDCR checkpoints, collection manifests, and broken maps use a separate storage mechanism (simple_store). Couchbase Server treats XDCR's log file (goxdcr.log) like other log files, and encrypts it when you enable encryption for logs. +XDCR checkpoints, collection manifests, and broken maps are stored in a separate internal storage mechanism and they are encrypted as well. ==== [#when-data-is-encrypted]