Keep server data in an encrypted database, and harden every part

Storage. The server keeps its data in SQLite (a file in the data
directory, the default) or PostgreSQL (database, KEEPORG_DATABASE_URL or
-database). Every row, the KDBX versions included, is sealed with
AES-256-GCM under a key derived from the master key and named by an HMAC.
The master key is required to start and a different one is refused. A data
directory from 0.10 or earlier is imported on first start. Several servers
may share one PostgreSQL database. Go goes to 1.26 for the pure-Go
drivers (modernc.org/sqlite, jackc/pgx).

Hardening, after an audit of the server, both clients and the deployment:
- Single sign-on approves a device only after an explicit Approve in the
  browser that started it, bound by a cookie and PKCE; identities are never
  linked by username, by verified email only when allowed, never to admins.
- Sign-in attempts are limited per address and per account, passwords are
  checked outside the store lock with uniform timing, one-time codes work
  once, and starting two-factor needs the password.
- Merge vaults bound KDF parameters, payload size and XML shape, check
  pushes before storing them, and run at most two merges at once. A version
  is written in the same transaction as its metadata.
- Tokens in URLs only on the event stream, which ends on revocation; CSP,
  frame-ancestors, no-store and HSTS; sign-in CSRF; 404 for databases
  without access; new trusted_proxies.
- Clients open only the server's approval page, keep case-variant and
  retired file names apart, never overwrite a save made during a pull,
  require https except locally, send the stream token in a header, bound
  their reads and escape notifications and terminal output.
- The .deb creates the master key, systemd is sandboxed further, nginx sets
  modern TLS and HSTS, and CI deploys from main only.

Server 0.12.0, desktop 0.6.0, Android 0.4.0 (versionCode 4).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Dockerfile

@@ -2,9 +2,10 @@
 
 # KeepOrg synchronization server.
 #
-# The server is a static binary with no third-party dependencies and no cgo,
-# so the runtime image carries the binary, a certificate bundle for talking
-# to an OIDC provider, and nothing else. There is no shell in it: the binary
+# The server is a static binary with no cgo — its only third-party code is
+# the two pure-Go database drivers — so the runtime image carries the
+# binary, a certificate bundle for talking to an OIDC provider or a
+# PostgreSQL server over TLS, and nothing else. There is no shell in it: the binary
 # probes its own health.
 #
 #   podman build --format docker -t keeporgd:<version> --build-arg VERSION=<version> .
@@ -15,14 +16,15 @@
 #
 # or `make docker`, which takes the version from versions.mk.
 
-FROM golang:1.24-alpine AS build
+FROM golang:1.26-alpine AS build
 
 ARG VERSION=dev
 WORKDIR /src
 
 # Only what the server is built from, so a change to the clients, the
 # Android app or the docs does not invalidate this layer.
-COPY go.mod ./
+COPY go.mod go.sum ./
+RUN go mod download
 COPY cmd/keeporgd ./cmd/keeporgd
 COPY internal ./internal
 
@@ -46,14 +48,15 @@ LABEL org.opencontainers.image.title="KeepOrg server" \
       org.opencontainers.image.licenses="AGPL-3.0-or-later" \
       cc.tiredsysadmin.application="cc.tiredsysadmin.linux.keeporgd"
 
-# Needed to reach an OIDC provider over TLS. Nothing else from the builder
+# Needed to reach an OIDC provider, or PostgreSQL, over TLS. Nothing else from the builder
 # comes along.
 COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
 
-# The data directory holds state.json and the KDBX blobs. The configuration
-# directory holds server.json and, unless the key is supplied through
-# KEEPORG_MASTER_KEY, the master key that unwraps the vault keys. They are
-# separate on purpose: whoever holds both can read every merge vault.
+# The data directory holds the SQLite database, unless KEEPORG_DATABASE_URL
+# points at PostgreSQL. Every row in it is sealed under the master key. The
+# configuration directory holds server.json and, unless the key is supplied
+# otherwise, that master key. They are separate on purpose: whoever holds
+# both can read everything, and either alone is useless.
 #
 # Give the master key somewhere durable, one of these three ways:
 #
@@ -67,9 +70,9 @@ COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certifica
 # a secret that failed to mount is reported instead of being replaced.
 #
 # With none of the three, the server mints a key into the container's own
-# layer on first start and loses it on the next `run`. It says so loudly at
-# startup, and merging is all that stops working: clients still open their
-# vaults.
+# layer on first start and loses it on the next `run`, after which it
+# refuses to start: the database does not open with a new key. Nothing is
+# overwritten; mount the original key and it starts.
 COPY --from=build --chown=65532:65532 /out/var/lib/keeporg /var/lib/keeporg
 COPY --from=build --chown=65532:65532 /out/etc/keeporg /etc/keeporg
 VOLUME ["/var/lib/keeporg", "/etc/keeporg"]