[byjpr]

Closes #22

Changes

docs/security.md → "Not covered" now explains:

• What is exposed: an unencrypted disk exposes all mail, plus the SSH host key and with it all secrets, to anyone who can read the provider's storage or snapshots.
• Why it's accepted: full-disk encryption on an unattended VM helps little, since the key is on the machine or someone types it at every reboot.
• The options and their trade-offs:
  • End-to-end encryption (OpenPGP/S/MIME): the only option that survives a compromised server.
  • Dovecot mail_crypt with per-user keys: encrypted at rest and readable only while the user is logged in, but it breaks server-side search and Sieve on stored mail, and a forgotten password loses the mail.
  • LUKS with SSH unlock in the initrd: protects discarded disks and offline snapshots; every reboot, including kernel updates, needs a person.
• Backups: off-site backups are encrypted by restic. That refers to Add encrypted off-site backups with restic #30's docs/backups.md.

No code changes: this is documentation of an accepted risk, as proposed in the issue.

🤖 Generated with Claude Code

https://claude.ai/code/session_01G22o7QQ17GRtkCqpJNFr9B

---

Generated by Claude Code