1.2 KiB
ADR-002: Application encryption and key lifecycle
- Status: Accepted
Decision
The Go server encrypts sensitive stored records and all private media. A random master key is generated during first setup and persisted at /config/master.key; it is not supplied by environment variable. Purpose-separated subkeys are derived for record/media classes.
Administrators may download a backup copy after strong reauthentication. There is no key recovery. A voluntary UI action can replace the key using a crash-safe, verified re-encryption workflow. Password-encrypted logical backups remain portable across instances and master keys.
Rationale
Application encryption protects data from casual volume/database disclosure while keeping deployment simple and enabling server-side charts, Web access, and operations. A file keeps the critical secret out of container environment inspection. Explicit replacement supports response to suspected exposure without making rotation a routine background risk.
Consequences
Loss of the key loses encrypted data. Operators must secure /config and key copies. Implementing re-encryption and backups requires migration journals, authenticated encryption, failure testing, and careful plaintext handling.