Johannes Millan
|
cb2e2e65a2
|
feat(supersync): implement Phase 1 encryption-at-rest tooling
Complete Phase 1 (Preparation & Tooling) deliverables:
Core Scripts (5):
- setup-encrypted-volume.sh: Create LUKS2 encrypted volumes with dual-key setup
- unlock-encrypted-volume.sh: Unlock volumes with audit logging
- backup-encrypted.sh: Streaming encrypted backups (no temp files)
- verify-prerequisites.sh: Environment validation (cryptsetup, AES-NI, kernel modules)
- discover-docker-names.sh: Helper to identify actual container/volume names
Configuration:
- docker-compose.encrypted.yaml: Overlay config for encrypted PostgreSQL
- encryption-at-rest.md: Architecture documentation (362 lines)
Technical Details:
- LUKS2 with AES-256-XTS (512-bit key for XTS mode)
- Argon2id key derivation (1GB memory, 4 threads)
- Dual-key setup: operational (daily use) + recovery (emergency)
- LUKS header backup with encryption
- OpenSSL AES-256-CBC for backup encryption (PBKDF2, 1M iterations)
- Audit logging for GDPR compliance
Also includes: Build workflow changes to temporarily disable SignPath
code signing while waiting for certificate issuance.
Total: 990 lines of encryption tooling and documentation.
|
2026-01-23 14:31:24 +01:00 |
|