3e6f3f58a9
Add comprehensive encrypted environment variable system with AES-256 encryption. Security Features: - AES-256-CBC encryption with PBKDF2 (100k iterations) - Root-only encryption key (/root/.tilbudgivern-secure/) - Encrypted .env.enc files safe to commit to git - Plaintext .env files only exist at runtime - Auto-cleanup on shutdown Components: - setup-encrypted-env.sh: Encrypt .env → .env.enc - decrypt-env.sh: Decrypt .env.enc → .env - start-secure.sh: Decrypt + start application - test-encryption.sh: Test encryption/decryption - tilbudgivern-secure.service: Systemd service Documentation: - ENCRYPTED_ENV_README.md: Overview and quick start - ENCRYPTED_ENV_QUICKSTART.md: Quick reference guide - docs/ENCRYPTED_ENV_SECURITY.md: Complete security guide Threat Model: ✅ User account compromise: Credentials safe ✅ Git repository leak: Only encrypted files exposed ✅ File system read: Encrypted files useless ❌ Root compromise: Defense in depth This ensures attackers need root access to decrypt credentials.
136 lines
3.5 KiB
Bash
Executable File
136 lines
3.5 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
################################################################################
|
|
# Encrypted Environment Setup Script
|
|
#
|
|
# This script creates encrypted .env files that can only be decrypted by root.
|
|
# It uses GPG with AES256 symmetric encryption and stores the key with
|
|
# root-only permissions.
|
|
#
|
|
# Security Features:
|
|
# - AES256 encryption
|
|
# - Root-only encryption key (600 permissions)
|
|
# - Encrypted .env files stored with 600 permissions
|
|
# - Original .env files never stored in git
|
|
# - Automatic key generation if not exists
|
|
################################################################################
|
|
|
|
set -e # Exit on error
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
PROJECT_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
|
|
SECURE_DIR="/root/.tilbudgivern-secure"
|
|
KEY_FILE="$SECURE_DIR/encryption.key"
|
|
|
|
# Colors for output
|
|
RED='\033[0;31m'
|
|
GREEN='\033[0;32m'
|
|
YELLOW='\033[1;33m'
|
|
NC='\033[0m' # No Color
|
|
|
|
log_info() {
|
|
echo -e "${GREEN}[INFO]${NC} $1"
|
|
}
|
|
|
|
log_warn() {
|
|
echo -e "${YELLOW}[WARN]${NC} $1"
|
|
}
|
|
|
|
log_error() {
|
|
echo -e "${RED}[ERROR]${NC} $1"
|
|
}
|
|
|
|
check_root() {
|
|
if [[ $EUID -ne 0 ]]; then
|
|
log_error "This script must be run as root"
|
|
echo "Please run: sudo $0"
|
|
exit 1
|
|
fi
|
|
}
|
|
|
|
setup_secure_directory() {
|
|
log_info "Setting up secure directory..."
|
|
|
|
if [[ ! -d "$SECURE_DIR" ]]; then
|
|
mkdir -p "$SECURE_DIR"
|
|
chmod 700 "$SECURE_DIR"
|
|
log_info "Created secure directory: $SECURE_DIR"
|
|
fi
|
|
}
|
|
|
|
generate_encryption_key() {
|
|
if [[ ! -f "$KEY_FILE" ]]; then
|
|
log_info "Generating new encryption key..."
|
|
# Generate a 256-bit (32-byte) random key
|
|
openssl rand -base64 32 > "$KEY_FILE"
|
|
chmod 600 "$KEY_FILE"
|
|
log_info "Encryption key created: $KEY_FILE"
|
|
else
|
|
log_info "Encryption key already exists: $KEY_FILE"
|
|
fi
|
|
}
|
|
|
|
encrypt_env_file() {
|
|
local env_file=$1
|
|
local encrypted_file="${env_file}.enc"
|
|
|
|
if [[ ! -f "$env_file" ]]; then
|
|
log_warn "File not found: $env_file (skipping)"
|
|
return
|
|
fi
|
|
|
|
log_info "Encrypting: $env_file"
|
|
|
|
# Encrypt using AES-256-CBC with key from file
|
|
openssl enc -aes-256-cbc -salt -pbkdf2 -iter 100000 \
|
|
-in "$env_file" \
|
|
-out "$encrypted_file" \
|
|
-pass file:"$KEY_FILE"
|
|
|
|
# Set secure permissions on encrypted file
|
|
chmod 600 "$encrypted_file"
|
|
chown root:root "$encrypted_file"
|
|
|
|
log_info "Created encrypted file: $encrypted_file"
|
|
}
|
|
|
|
main() {
|
|
log_info "Starting encrypted environment setup..."
|
|
|
|
check_root
|
|
setup_secure_directory
|
|
generate_encryption_key
|
|
|
|
# Array of .env files to encrypt
|
|
ENV_FILES=(
|
|
"$PROJECT_ROOT/backend/.env"
|
|
"$PROJECT_ROOT/frontend/.env"
|
|
"$PROJECT_ROOT/frontend/.env.production"
|
|
"$PROJECT_ROOT/_config/.env.ordrestyring"
|
|
)
|
|
|
|
log_info "Encrypting environment files..."
|
|
|
|
for env_file in "${ENV_FILES[@]}"; do
|
|
if [[ -f "$env_file" ]]; then
|
|
encrypt_env_file "$env_file"
|
|
fi
|
|
done
|
|
|
|
echo ""
|
|
log_info "✅ Encryption complete!"
|
|
echo ""
|
|
log_info "Security summary:"
|
|
echo " - Encryption key: $KEY_FILE (root only, 600)"
|
|
echo " - Encrypted files: *.env.enc (root only, 600)"
|
|
echo " - Algorithm: AES-256-CBC with PBKDF2 (100,000 iterations)"
|
|
echo ""
|
|
log_warn "IMPORTANT: Keep your .env files in .gitignore"
|
|
log_warn "Only .env.enc files should exist on the server"
|
|
echo ""
|
|
log_info "To decrypt for application use, run:"
|
|
echo " sudo $SCRIPT_DIR/decrypt-env.sh"
|
|
}
|
|
|
|
main
|