mirror of
https://github.com/johannesjo/super-productivity.git
synced 2026-07-20 18:08:55 +00:00
cb2e2e65a2
Complete Phase 1 (Preparation & Tooling) deliverables: Core Scripts (5): - setup-encrypted-volume.sh: Create LUKS2 encrypted volumes with dual-key setup - unlock-encrypted-volume.sh: Unlock volumes with audit logging - backup-encrypted.sh: Streaming encrypted backups (no temp files) - verify-prerequisites.sh: Environment validation (cryptsetup, AES-NI, kernel modules) - discover-docker-names.sh: Helper to identify actual container/volume names Configuration: - docker-compose.encrypted.yaml: Overlay config for encrypted PostgreSQL - encryption-at-rest.md: Architecture documentation (362 lines) Technical Details: - LUKS2 with AES-256-XTS (512-bit key for XTS mode) - Argon2id key derivation (1GB memory, 4 threads) - Dual-key setup: operational (daily use) + recovery (emergency) - LUKS header backup with encryption - OpenSSL AES-256-CBC for backup encryption (PBKDF2, 1M iterations) - Audit logging for GDPR compliance Also includes: Build workflow changes to temporarily disable SignPath code signing while waiting for certificate issuance. Total: 990 lines of encryption tooling and documentation.
48 lines
1.8 KiB
YAML
48 lines
1.8 KiB
YAML
# Docker Compose overlay for encrypted PostgreSQL data at rest
|
|
#
|
|
# This file adds LUKS encryption at rest for the PostgreSQL database.
|
|
# It MUST be used as an overlay with the base docker-compose.yml:
|
|
#
|
|
# Usage:
|
|
# 1. Create encrypted LUKS volume: ./tools/setup-encrypted-volume.sh --size 50G
|
|
# 2. Unlock volume: sudo ./tools/unlock-encrypted-volume.sh pg-data-encrypted
|
|
# 3. Start with encryption: docker compose -f docker-compose.yml -f docker-compose.encrypted.yaml up -d
|
|
#
|
|
# CRITICAL:
|
|
# - The encrypted volume MUST be unlocked BEFORE starting containers
|
|
# - Run: ./tools/unlock-encrypted-volume.sh pg-data-encrypted
|
|
# - Without manual unlock, container startup will fail
|
|
|
|
version: '3.8'
|
|
|
|
services:
|
|
postgres:
|
|
# Override restart policy: requires manual unlock after reboot
|
|
restart: 'no'
|
|
|
|
volumes:
|
|
# Replace named volume with bind mount to encrypted filesystem
|
|
# IMPORTANT: /mnt/pg-data-encrypted MUST be unlocked and mounted first!
|
|
- /mnt/pg-data-encrypted:/var/lib/postgresql/data
|
|
|
|
healthcheck:
|
|
# Enhanced healthcheck: verify both PostgreSQL AND data directory exists
|
|
test:
|
|
- 'CMD-SHELL'
|
|
- |
|
|
pg_isready -U ${POSTGRES_USER:-supersync} -d ${POSTGRES_DB:-supersync} && \
|
|
test -d /var/lib/postgresql/data/base || \
|
|
(echo "ERROR: Data directory missing - encrypted volume not mounted!" && exit 1)
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 5
|
|
start_period: 30s # Allow extra time for mount verification
|
|
|
|
# Remove the named volume - we're using bind mount instead
|
|
volumes:
|
|
postgres-data:
|
|
external: false
|
|
name: postgres-data-unused
|
|
|
|
# NOTE: No changes to supersync service - it connects to postgres normally
|
|
# NOTE: No changes to caddy service - it proxies to supersync normally
|