From f63825ea7c49a0b96c129b4f3455fb32eba89a63 Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 9 Oct 2026 20:03:03 +0000 Subject: [PATCH] Document encryption at rest as an accepted risk, with options Explain what an unencrypted disk exposes, why full-disk encryption on an unattended VM helps little, and the options: end-to-end encryption, Dovecot mail_crypt with per-user keys, and LUKS with SSH unlock in the initrd, with their trade-offs. Closes #22 Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01G22o7QQ17GRtkCqpJNFr9B --- docs/security.md | 21 +++++++++++++++++++-- 1 file changed, 19 insertions(+), 2 deletions(-) diff --git a/docs/security.md b/docs/security.md index e0ab859..addcf8c 100644 --- a/docs/security.md +++ b/docs/security.md @@ -100,8 +100,25 @@ If your age key leaks, generate a new one, update `.sops.yaml`, run ## Not covered -- **Encryption at rest.** The server's disk isn't encrypted (an unattended - server would need the key on the same machine). +- **Encryption at rest** (accepted risk). The disk is not encrypted, so + whoever can read the provider's storage, snapshots or disk images can read + all mail and the server's SSH host key (and with it, all secrets). Full-disk + encryption on an unattended VM doesn't change that much: the unlock key + must be on the machine, or someone must type it after every reboot. The + options, from most to least effort: + - **End-to-end encryption** (OpenPGP or S/MIME) for mail that matters: the + only option that also protects against a compromised server. + - **Dovecot `mail_crypt`** with per-user keys derived from the user's + password: mail is encrypted on disk and only readable while the user is + logged in. Breaks server-side features that need to read mail (search + indexes, Sieve on stored mail) and makes a forgotten password fatal. + - **LUKS with remote unlock**: full-disk encryption, unlocked over SSH in + the initrd (`boot.initrd.network.ssh`) after every reboot. Protects + discarded disks and offline snapshots, not a running server; reboots + (and therefore kernel updates) then need you. + + The off-site backups (`docs/backups.md`) are encrypted by restic before + they leave the server. - **Virus scanning** (ClamAV) is off because of the 1 GB RAM budget; see the README. - **DNSSEC** for your own zones is up to your DNS host; turn it on in