tilbudgivern/docs/ENCRYPTED_ENV_QUICKSTART.md

Encrypted Environment - Quick Start

🔐 What This Is

All credentials are now encrypted with AES-256 and can only be decrypted by root. This prevents credential theft even if someone gains access to your user account.

📋 Quick Commands

First Time Setup

# 1. Create your .env files (one time)
nano backend/.env     # Add your credentials
nano frontend/.env    # Add your credentials

# 2. Encrypt them (requires root)
sudo ./scripts/setup-encrypted-env.sh

# 3. Remove plaintext (they're now in .env.enc)
rm backend/.env frontend/.env

# 4. Commit encrypted files
git add **/*.env.enc
git commit -m "Add encrypted environment files"

Daily Development

# Start application (auto-decrypts, requires root)
sudo ./scripts/start-secure.sh

# OR manually decrypt and start
sudo ./scripts/decrypt-env.sh
npm start  # in backend/

Update Credentials

# 1. Decrypt
sudo ./scripts/decrypt-env.sh

# 2. Edit
nano backend/.env

# 3. Re-encrypt
sudo ./scripts/setup-encrypted-env.sh

# 4. Cleanup and commit
sudo ./scripts/decrypt-env.sh --cleanup
git add backend/.env.enc
git commit -m "Update credentials"

🛡️ Security Model

Attack Scenario: User account compromised
- ❌ Attacker has user permissions
- ❌ Attacker can read encrypted .env.enc files
- ❌ Attacker CANNOT read /root/.tilbudgivern-secure/encryption.key
- ✅ Result: Credentials remain safe

Attack Scenario: Root access required
- ✅ Attacker needs root access to decrypt
- ✅ If they have root, system is already compromised
- ✅ Defense in depth: root access = security incident

📁 File Structure

/root/.tilbudgivern-secure/
└── encryption.key              # 600, root only - NEVER in git

/mnt/HC_Volume_103713257/tilbudgivern/
├── backend/
│   ├── .env.enc               # ✅ Encrypted, in git
│   └── .env                   # ❌ Decrypted, runtime only
├── frontend/
│   ├── .env.enc               # ✅ Encrypted, in git
│   └── .env                   # ❌ Decrypted, runtime only
└── scripts/
    ├── setup-encrypted-env.sh  # Encrypts .env → .env.enc
    ├── decrypt-env.sh          # Decrypts .env.enc → .env
    └── start-secure.sh         # Decrypt + Start app

🚀 Production Deployment

Systemd Service (Recommended)

# Install service
sudo cp scripts/tilbudgivern-secure.service /etc/systemd/system/
sudo systemctl daemon-reload

# Enable and start
sudo systemctl enable tilbudgivern-secure
sudo systemctl start tilbudgivern-secure

# Check status
sudo systemctl status tilbudgivern-secure

The service will:

• Auto-decrypt on startup
• Run app as user (alex)
• Auto-cleanup on shutdown

⚠️ Important Notes

DO Commit

• ✅ .env.enc files (encrypted)
• ✅ .env.example files (templates)
• ✅ Scripts in scripts/ directory

NEVER Commit

• ❌ .env files (plaintext)
• ❌ /root/.tilbudgivern-secure/encryption.key
• ❌ Any file with actual credentials

Backup Strategy

• Git: Store .env.enc files
• Secure offline: Store encryption key separately
• Recovery: Need both .env.enc + key to decrypt

🔑 Key Management

Backup Encryption Key

# View key (for backup)
sudo cat /root/.tilbudgivern-secure/encryption.key

# Copy to secure location
sudo cp /root/.tilbudgivern-secure/encryption.key /secure/backup/

Rotate Key

# Decrypt with old key
sudo ./scripts/decrypt-env.sh

# Remove old key
sudo rm /root/.tilbudgivern-secure/encryption.key

# Generate new key and re-encrypt
sudo ./scripts/setup-encrypted-env.sh

# Test
sudo ./scripts/decrypt-env.sh

🐛 Troubleshooting

"Encryption key not found"

sudo ./scripts/setup-encrypted-env.sh  # Generate new key
# OR restore from backup

"Bad decrypt"

• Wrong encryption key
• Corrupted .env.enc file
• Restore key from backup

Permission errors

• Scripts need sudo
• Check: ls -la /root/.tilbudgivern-secure/

📚 Full Documentation

See docs/ENCRYPTED_ENV_SECURITY.md for:

• Detailed security architecture
• Key rotation procedures
• Backup and recovery
• Production best practices

🎯 Quick Reference

Task	Command
Encrypt env files	sudo ./scripts/setup-encrypted-env.sh
Decrypt for use	sudo ./scripts/decrypt-env.sh
Start app	sudo ./scripts/start-secure.sh
Cleanup decrypted	sudo ./scripts/decrypt-env.sh --cleanup
View logs	sudo journalctl -u tilbudgivern-secure -f

✅ Security Checklist

Before going to production:

• All .env files encrypted to .env.enc
• Encryption key backed up (not in git!)
• .env.enc files committed to git
• Plaintext .env files removed/cleaned
• Systemd service configured
• Tested decrypt → start → cleanup cycle
• Encryption key permissions: 600 root:root
• Application runs as non-root user