3e6f3f58a9
Add comprehensive encrypted environment variable system with AES-256 encryption. Security Features: - AES-256-CBC encryption with PBKDF2 (100k iterations) - Root-only encryption key (/root/.tilbudgivern-secure/) - Encrypted .env.enc files safe to commit to git - Plaintext .env files only exist at runtime - Auto-cleanup on shutdown Components: - setup-encrypted-env.sh: Encrypt .env → .env.enc - decrypt-env.sh: Decrypt .env.enc → .env - start-secure.sh: Decrypt + start application - test-encryption.sh: Test encryption/decryption - tilbudgivern-secure.service: Systemd service Documentation: - ENCRYPTED_ENV_README.md: Overview and quick start - ENCRYPTED_ENV_QUICKSTART.md: Quick reference guide - docs/ENCRYPTED_ENV_SECURITY.md: Complete security guide Threat Model: ✅ User account compromise: Credentials safe ✅ Git repository leak: Only encrypted files exposed ✅ File system read: Encrypted files useless ❌ Root compromise: Defense in depth This ensures attackers need root access to decrypt credentials.
85 lines
1.9 KiB
Bash
Executable File
85 lines
1.9 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
################################################################################
|
|
# Secure Application Startup Script
|
|
#
|
|
# This script:
|
|
# 1. Decrypts environment files (requires root)
|
|
# 2. Starts the application as the application user
|
|
# 3. Optionally cleans up decrypted files on exit
|
|
#
|
|
# Usage:
|
|
# sudo ./start-secure.sh [--cleanup-on-exit]
|
|
################################################################################
|
|
|
|
set -e
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
PROJECT_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
|
|
APP_USER="alex"
|
|
CLEANUP_ON_EXIT=false
|
|
|
|
# Colors
|
|
GREEN='\033[0;32m'
|
|
YELLOW='\033[1;33m'
|
|
NC='\033[0m'
|
|
|
|
log_info() {
|
|
echo -e "${GREEN}[INFO]${NC} $1"
|
|
}
|
|
|
|
log_warn() {
|
|
echo -e "${YELLOW}[WARN]${NC} $1"
|
|
}
|
|
|
|
cleanup() {
|
|
if [[ "$CLEANUP_ON_EXIT" == true ]]; then
|
|
log_info "Cleaning up decrypted environment files..."
|
|
"$SCRIPT_DIR/decrypt-env.sh" --cleanup
|
|
fi
|
|
}
|
|
|
|
# Parse arguments
|
|
if [[ "$1" == "--cleanup-on-exit" ]]; then
|
|
CLEANUP_ON_EXIT=true
|
|
trap cleanup EXIT
|
|
fi
|
|
|
|
# Check if running as root
|
|
if [[ $EUID -ne 0 ]]; then
|
|
echo "This script must be run as root"
|
|
echo "Please run: sudo $0 $*"
|
|
exit 1
|
|
fi
|
|
|
|
log_info "Step 1: Decrypting environment files..."
|
|
"$SCRIPT_DIR/decrypt-env.sh"
|
|
|
|
log_info "Step 2: Starting application as user: $APP_USER"
|
|
cd "$PROJECT_ROOT"
|
|
|
|
# Start backend
|
|
log_info "Starting backend server..."
|
|
su - "$APP_USER" -c "cd $PROJECT_ROOT/backend && npm start &"
|
|
|
|
# Wait a moment
|
|
sleep 2
|
|
|
|
# Start frontend (if applicable)
|
|
if [[ -f "$PROJECT_ROOT/frontend/package.json" ]]; then
|
|
log_info "Starting frontend server..."
|
|
su - "$APP_USER" -c "cd $PROJECT_ROOT/frontend && npm start &"
|
|
fi
|
|
|
|
log_info "✅ Application started successfully!"
|
|
|
|
if [[ "$CLEANUP_ON_EXIT" == true ]]; then
|
|
log_warn "Environment files will be cleaned up when this script exits"
|
|
log_info "Press Ctrl+C to stop and cleanup"
|
|
|
|
# Keep script running
|
|
while true; do
|
|
sleep 10
|
|
done
|
|
fi
|