3e6f3f58a9
Add comprehensive encrypted environment variable system with AES-256 encryption. Security Features: - AES-256-CBC encryption with PBKDF2 (100k iterations) - Root-only encryption key (/root/.tilbudgivern-secure/) - Encrypted .env.enc files safe to commit to git - Plaintext .env files only exist at runtime - Auto-cleanup on shutdown Components: - setup-encrypted-env.sh: Encrypt .env → .env.enc - decrypt-env.sh: Decrypt .env.enc → .env - start-secure.sh: Decrypt + start application - test-encryption.sh: Test encryption/decryption - tilbudgivern-secure.service: Systemd service Documentation: - ENCRYPTED_ENV_README.md: Overview and quick start - ENCRYPTED_ENV_QUICKSTART.md: Quick reference guide - docs/ENCRYPTED_ENV_SECURITY.md: Complete security guide Threat Model: ✅ User account compromise: Credentials safe ✅ Git repository leak: Only encrypted files exposed ✅ File system read: Encrypted files useless ❌ Root compromise: Defense in depth This ensures attackers need root access to decrypt credentials.
37 lines
823 B
Desktop File
37 lines
823 B
Desktop File
[Unit]
|
|
Description=Tilbudgivern Application (Secure)
|
|
After=network.target
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=forking
|
|
User=root
|
|
WorkingDirectory=/mnt/HC_Volume_103713257/tilbudgivern
|
|
|
|
# Decrypt environment files before starting
|
|
ExecStartPre=/mnt/HC_Volume_103713257/tilbudgivern/scripts/decrypt-env.sh
|
|
|
|
# Start backend as alex user
|
|
ExecStart=/bin/su - alex -c "cd /mnt/HC_Volume_103713257/tilbudgivern/backend && npm start"
|
|
|
|
# Cleanup decrypted files on stop
|
|
ExecStopPost=/mnt/HC_Volume_103713257/tilbudgivern/scripts/decrypt-env.sh --cleanup
|
|
|
|
# Security settings
|
|
ProtectSystem=strict
|
|
ProtectHome=true
|
|
NoNewPrivileges=true
|
|
PrivateTmp=true
|
|
|
|
# Restart policy
|
|
Restart=on-failure
|
|
RestartSec=10s
|
|
|
|
# Logging
|
|
StandardOutput=journal
|
|
StandardError=journal
|
|
SyslogIdentifier=tilbudgivern
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|