feat: optional password encryption for backup and domain export (code-review.md § Phase 1.5)
Both secret-bearing downloads can now be sealed with a password. Unticked, the forms produce exactly the files they did before. - internal/secretfile: envelope format — magic/type/scrypt params/salt/nonce prefix header, then 64 KiB AES-256-GCM chunks each authenticated with the header, its counter and an end-of-stream flag, so truncation, reordering and tampering fail to open instead of restoring a plausible prefix. Streams both ways, so a full backup never sits in memory. - Panel: "Encrypt with a password" checkbox on the full-backup and domain-export forms (shared partial, toggled from panel.js — no inline script); domain import detects an encrypted export by magic bytes, not by extension, and asks for the password. - selfpost-backup: writes .spbk when given a password and converts one back with -decrypt, which a restore needs. The password comes from SELFPOST_BACKUP_PASSWORD or -password-file, never argv. - Docs: README, security.md (+ accepted risk: encryption stays opt-in), architecture.md, progress.md, CHANGELOG. Verified locally: panel-encrypted archive decrypts through the CLI and unpacks; wrong password and password mismatch are refused; UI checked in a browser. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
+126
-11
@@ -9,21 +9,39 @@
|
||||
// Use -o to write to a file instead. The resulting archive contains DKIM private
|
||||
// keys, the admin password hash and SASL credentials — treat it as a secret
|
||||
// (spec 7.5.A).
|
||||
//
|
||||
// Given a password (SELFPOST_BACKUP_PASSWORD or -password-file, never an
|
||||
// argument, which would show up in the process list) the archive is written as
|
||||
// an encrypted .spbk envelope instead. Turn one back into a plain .tar.gz with
|
||||
// the same password:
|
||||
//
|
||||
// docker exec -i <container> selfpost-backup -decrypt < backup.spbk > backup.tar.gz
|
||||
package main
|
||||
|
||||
import (
|
||||
"flag"
|
||||
"fmt"
|
||||
"io"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
|
||||
"codeberg.org/mix/selfpost/internal/backup"
|
||||
"codeberg.org/mix/selfpost/internal/buildinfo"
|
||||
"codeberg.org/mix/selfpost/internal/secretfile"
|
||||
)
|
||||
|
||||
// passwordEnv names the environment variable holding the encryption password.
|
||||
// A password must never be a command-line argument: the process list is
|
||||
// readable by every process in the container.
|
||||
const passwordEnv = "SELFPOST_BACKUP_PASSWORD"
|
||||
|
||||
func main() {
|
||||
showVersion := flag.Bool("version", false, "print version and exit")
|
||||
out := flag.String("o", "", "write the archive to this file instead of stdout")
|
||||
out := flag.String("o", "", "write the output to this file instead of stdout")
|
||||
in := flag.String("i", "", "read the encrypted archive from this file instead of stdin (-decrypt only)")
|
||||
decrypt := flag.Bool("decrypt", false, "decrypt an encrypted backup (.spbk) back to a plain .tar.gz")
|
||||
pwFile := flag.String("password-file", "", "read the encryption password from this file (first line); "+passwordEnv+" is used when unset")
|
||||
flag.Parse()
|
||||
|
||||
if *showVersion {
|
||||
@@ -31,40 +49,137 @@ func main() {
|
||||
return
|
||||
}
|
||||
|
||||
if err := run(*out); err != nil {
|
||||
password, err := readPassword(*pwFile)
|
||||
if err == nil {
|
||||
if *decrypt {
|
||||
err = runDecrypt(*in, *out, password)
|
||||
} else {
|
||||
err = run(*out, password)
|
||||
}
|
||||
}
|
||||
if err != nil {
|
||||
fmt.Fprintf(os.Stderr, "selfpost-backup: %v\n", err)
|
||||
os.Exit(1)
|
||||
}
|
||||
}
|
||||
|
||||
func run(outPath string) error {
|
||||
// run writes a backup, encrypting it when a password was supplied.
|
||||
func run(outPath, password string) error {
|
||||
dataDir := envDefault("SELFPOST_DATA_DIR", "/data")
|
||||
dbPath := envDefault("SELFPOST_DB_PATH", filepath.Join(dataDir, "selfpost.db"))
|
||||
|
||||
w := os.Stdout
|
||||
if outPath != "" {
|
||||
// Backups are secret; create them owner-only.
|
||||
f, err := os.OpenFile(outPath, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0o600)
|
||||
w, closeOut, err := openOutput(outPath)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer closeOut()
|
||||
|
||||
sink := w
|
||||
var env *secretfile.Writer
|
||||
if password != "" {
|
||||
env, err = secretfile.NewWriter(w, secretfile.TypeFullBackup, password)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer f.Close()
|
||||
w = f
|
||||
sink = env
|
||||
}
|
||||
|
||||
if err := backup.Create(w, backup.Params{
|
||||
if err := backup.Create(sink, backup.Params{
|
||||
DataDir: dataDir,
|
||||
DBPath: dbPath,
|
||||
Version: buildinfo.Version,
|
||||
}); err != nil {
|
||||
return err
|
||||
}
|
||||
if env != nil {
|
||||
if err := env.Close(); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
if outPath != "" {
|
||||
fmt.Fprintf(os.Stderr, "selfpost-backup: wrote %s (SelfPost %s)\n", outPath, buildinfo.Version)
|
||||
kind := "plain"
|
||||
if password != "" {
|
||||
kind = "encrypted"
|
||||
}
|
||||
fmt.Fprintf(os.Stderr, "selfpost-backup: wrote %s (%s, SelfPost %s)\n", outPath, kind, buildinfo.Version)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// runDecrypt turns a .spbk envelope back into the plain gzip tar, so an
|
||||
// encrypted backup can be extracted with ordinary tools during a restore.
|
||||
func runDecrypt(inPath, outPath, password string) error {
|
||||
if password == "" {
|
||||
return fmt.Errorf("-decrypt needs the password (set %s or use -password-file)", passwordEnv)
|
||||
}
|
||||
|
||||
r := io.Reader(os.Stdin)
|
||||
if inPath != "" {
|
||||
f, err := os.Open(inPath)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer f.Close()
|
||||
r = f
|
||||
}
|
||||
|
||||
env, err := secretfile.NewReader(r, password)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if env.Type() != secretfile.TypeFullBackup {
|
||||
return fmt.Errorf("that file is a %s, not a full backup", env.Type())
|
||||
}
|
||||
|
||||
w, closeOut, err := openOutput(outPath)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer closeOut()
|
||||
|
||||
if _, err := io.Copy(w, env); err != nil {
|
||||
return err
|
||||
}
|
||||
if outPath != "" {
|
||||
fmt.Fprintf(os.Stderr, "selfpost-backup: wrote %s (decrypted)\n", outPath)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// openOutput returns stdout, or a freshly created owner-only file: both plain
|
||||
// and encrypted backups are secret enough to keep off other users' eyes.
|
||||
func openOutput(outPath string) (io.Writer, func(), error) {
|
||||
if outPath == "" {
|
||||
return os.Stdout, func() {}, nil
|
||||
}
|
||||
f, err := os.OpenFile(outPath, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0o600)
|
||||
if err != nil {
|
||||
return nil, nil, err
|
||||
}
|
||||
return f, func() { _ = f.Close() }, nil
|
||||
}
|
||||
|
||||
// readPassword takes the password from the given file (first line) or, when no
|
||||
// file is named, from the environment. An empty result means "no encryption".
|
||||
func readPassword(pwFile string) (string, error) {
|
||||
if pwFile == "" {
|
||||
return os.Getenv(passwordEnv), nil
|
||||
}
|
||||
data, err := os.ReadFile(pwFile)
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("read password file: %w", err)
|
||||
}
|
||||
// A password file is usually written with a trailing newline; take the first
|
||||
// line and strip the line ending, but keep any other whitespace, which may
|
||||
// well be part of the password.
|
||||
line, _, _ := strings.Cut(string(data), "\n")
|
||||
line = strings.TrimSuffix(line, "\r")
|
||||
if line == "" {
|
||||
return "", fmt.Errorf("password file %s is empty", pwFile)
|
||||
}
|
||||
return line, nil
|
||||
}
|
||||
|
||||
func envDefault(key, def string) string {
|
||||
if v := os.Getenv(key); v != "" {
|
||||
return v
|
||||
|
||||
@@ -0,0 +1,139 @@
|
||||
package main
|
||||
|
||||
import (
|
||||
"archive/tar"
|
||||
"compress/gzip"
|
||||
"io"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
"codeberg.org/mix/selfpost/internal/store"
|
||||
)
|
||||
|
||||
// seedDataDir builds the minimum /data tree a backup can be taken from.
|
||||
func seedDataDir(t *testing.T) string {
|
||||
t.Helper()
|
||||
dataDir := t.TempDir()
|
||||
st, err := store.Open(filepath.Join(dataDir, "selfpost.db"))
|
||||
if err != nil {
|
||||
t.Fatalf("open store: %v", err)
|
||||
}
|
||||
if _, err := st.AddDomain("example.com", "selfpost"); err != nil {
|
||||
t.Fatalf("add domain: %v", err)
|
||||
}
|
||||
if err := st.Close(); err != nil {
|
||||
t.Fatalf("close store: %v", err)
|
||||
}
|
||||
t.Setenv("SELFPOST_DATA_DIR", dataDir)
|
||||
t.Setenv("SELFPOST_DB_PATH", filepath.Join(dataDir, "selfpost.db"))
|
||||
return dataDir
|
||||
}
|
||||
|
||||
// An encrypted backup is only worth having if the container it came from can
|
||||
// hand it back as an ordinary archive during a restore, so the two halves of
|
||||
// the CLI are tested as the one round trip an operator actually performs.
|
||||
func TestEncryptedBackupRoundTrip(t *testing.T) {
|
||||
seedDataDir(t)
|
||||
dir := t.TempDir()
|
||||
encrypted := filepath.Join(dir, "backup.spbk")
|
||||
plain := filepath.Join(dir, "backup.tar.gz")
|
||||
const password = "a long enough password"
|
||||
|
||||
if err := run(encrypted, password); err != nil {
|
||||
t.Fatalf("create encrypted backup: %v", err)
|
||||
}
|
||||
head, err := os.ReadFile(encrypted)
|
||||
if err != nil {
|
||||
t.Fatalf("read backup: %v", err)
|
||||
}
|
||||
if !strings.HasPrefix(string(head), "SELFPOST") {
|
||||
t.Fatalf("encrypted backup does not start with the envelope magic")
|
||||
}
|
||||
|
||||
if err := runDecrypt(encrypted, plain, "the wrong password"); err == nil {
|
||||
t.Fatal("decryption with the wrong password succeeded")
|
||||
}
|
||||
if err := runDecrypt(encrypted, plain, password); err != nil {
|
||||
t.Fatalf("decrypt: %v", err)
|
||||
}
|
||||
|
||||
// What comes out must be the same gzip tar the plain path produces.
|
||||
f, err := os.Open(plain)
|
||||
if err != nil {
|
||||
t.Fatalf("open decrypted archive: %v", err)
|
||||
}
|
||||
defer f.Close()
|
||||
gz, err := gzip.NewReader(f)
|
||||
if err != nil {
|
||||
t.Fatalf("gzip: %v", err)
|
||||
}
|
||||
names := map[string]bool{}
|
||||
tr := tar.NewReader(gz)
|
||||
for {
|
||||
hdr, err := tr.Next()
|
||||
if err == io.EOF {
|
||||
break
|
||||
}
|
||||
if err != nil {
|
||||
t.Fatalf("tar: %v", err)
|
||||
}
|
||||
names[hdr.Name] = true
|
||||
}
|
||||
for _, want := range []string{"manifest.json", "selfpost.db"} {
|
||||
if !names[want] {
|
||||
t.Errorf("decrypted archive has no %s (entries: %v)", want, names)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Without a password the CLI keeps producing the plain archive that existing
|
||||
// backup scripts consume.
|
||||
func TestUnencryptedBackupStaysPlain(t *testing.T) {
|
||||
seedDataDir(t)
|
||||
out := filepath.Join(t.TempDir(), "backup.tar.gz")
|
||||
if err := run(out, ""); err != nil {
|
||||
t.Fatalf("create backup: %v", err)
|
||||
}
|
||||
f, err := os.Open(out)
|
||||
if err != nil {
|
||||
t.Fatalf("open archive: %v", err)
|
||||
}
|
||||
defer f.Close()
|
||||
if _, err := gzip.NewReader(f); err != nil {
|
||||
t.Fatalf("plain backup is not a gzip archive: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
// Decrypting needs a password, and it must come from a file or the environment
|
||||
// — never an argument, which the process list would expose.
|
||||
func TestReadPassword(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
pwFile := filepath.Join(dir, "pw")
|
||||
if err := os.WriteFile(pwFile, []byte("from the file\nignored second line\n"), 0o600); err != nil {
|
||||
t.Fatalf("write password file: %v", err)
|
||||
}
|
||||
|
||||
t.Setenv(passwordEnv, "from the environment")
|
||||
got, err := readPassword("")
|
||||
if err != nil || got != "from the environment" {
|
||||
t.Errorf("readPassword(\"\") = %q, %v", got, err)
|
||||
}
|
||||
got, err = readPassword(pwFile)
|
||||
if err != nil || got != "from the file" {
|
||||
t.Errorf("readPassword(file) = %q, %v", got, err)
|
||||
}
|
||||
|
||||
if err := os.WriteFile(pwFile, nil, 0o600); err != nil {
|
||||
t.Fatalf("truncate password file: %v", err)
|
||||
}
|
||||
if _, err := readPassword(pwFile); err == nil {
|
||||
t.Error("an empty password file was accepted")
|
||||
}
|
||||
|
||||
os.Unsetenv(passwordEnv)
|
||||
if err := runDecrypt("", "", ""); err == nil {
|
||||
t.Error("-decrypt without a password was accepted")
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user