alexpolo1
3e6f3f58a9
feat: Implement root-only encrypted environment system
Add comprehensive encrypted environment variable system with AES-256 encryption.
Security Features:
- AES-256-CBC encryption with PBKDF2 (100k iterations)
- Root-only encryption key (/root/.tilbudgivern-secure/)
- Encrypted .env.enc files safe to commit to git
- Plaintext .env files only exist at runtime
- Auto-cleanup on shutdown
Components:
- setup-encrypted-env.sh: Encrypt .env → .env.enc
- decrypt-env.sh: Decrypt .env.enc → .env
- start-secure.sh: Decrypt + start application
- test-encryption.sh: Test encryption/decryption
- tilbudgivern-secure.service: Systemd service
Documentation:
- ENCRYPTED_ENV_README.md: Overview and quick start
- ENCRYPTED_ENV_QUICKSTART.md: Quick reference guide
- docs/ENCRYPTED_ENV_SECURITY.md: Complete security guide
Threat Model:
✅ User account compromise: Credentials safe
✅ Git repository leak: Only encrypted files exposed
✅ File system read: Encrypted files useless
❌ Root compromise: Defense in depth
This ensures attackers need root access to decrypt credentials.
2025-12-20 13:36:30 +00:00
..
2025-11-16 21:12:29 +00:00
2025-11-16 21:12:29 +00:00
2025-12-20 13:36:30 +00:00
2025-11-16 21:12:29 +00:00
2025-11-16 21:12:29 +00:00
2025-11-16 21:12:29 +00:00
2025-12-20 13:36:30 +00:00
2025-12-20 13:36:30 +00:00
2025-12-20 13:36:30 +00:00
2025-12-20 13:36:30 +00:00