Is there a mechanism for encrypting DB connection string passwords in config.yaml?

hey! not at the moment. But a question - how would that work anyway? Cause then you would need to provide the encryption key as well in the config - which would beat the point of encrypting it

Good question. Not sure but wondering if there's a way to NOT keep the password in clear text.

Not at the moment. If you can think of or find a way which would actually make things secure, feel free to open a github issue about it and we can add it to our TODOs 🙂

Perhaps with a public/private key pair? The config file contains the password encrypted with the public key and the core module decrypts it with the private key.

How would the core know what the private key is?

The admin puts the private key in the key store. I think that's the standard practice but I don't know the details.

which key store?

You figure it out 🙂

hehe.. well