Keep server data in an encrypted database, and harden every part

Storage. The server keeps its data in SQLite (a file in the data directory, the default) or PostgreSQL (database, KEEPORG_DATABASE_URL or -database). Every row, the KDBX versions included, is sealed with AES-256-GCM under a key derived from the master key and named by an HMAC. The master key is required to start and a different one is refused. A data directory from 0.10 or earlier is imported on first start. Several servers may share one PostgreSQL database. Go goes to 1.26 for the pure-Go drivers (modernc.org/sqlite, jackc/pgx). Hardening, after an audit of the server, both clients and the deployment: - Single sign-on approves a device only after an explicit Approve in the browser that started it, bound by a cookie and PKCE; identities are never linked by username, by verified email only when allowed, never to admins. - Sign-in attempts are limited per address and per account, passwords are checked outside the store lock with uniform timing, one-time codes work once, and starting two-factor needs the password. - Merge vaults bound KDF parameters, payload size and XML shape, check pushes before storing them, and run at most two merges at once. A version is written in the same transaction as its metadata. - Tokens in URLs only on the event stream, which ends on revocation; CSP, frame-ancestors, no-store and HSTS; sign-in CSRF; 404 for databases without access; new trusted_proxies. - Clients open only the server's approval page, keep case-variant and retired file names apart, never overwrite a save made during a pull, require https except locally, send the stream token in a header, bound their reads and escape notifications and terminal output. - The .deb creates the master key, systemd is sandboxed further, nginx sets modern TLS and HSTS, and CI deploys from main only. Server 0.12.0, desktop 0.6.0, Android 0.4.0 (versionCode 4). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-11-02 15:38:32 +01:00
parent f8f634fbf7
commit 4ffc434b1b
77 changed files with 4192 additions and 776 deletions
@@ -8,7 +8,9 @@ package server
 import (
 	"encoding/json"
 	"errors"
+	"fmt"
 	"log"
+	"net"
 	"net/http"
 	"path/filepath"
 	"strings"
@@ -17,6 +19,7 @@ import (
 	"cc.tiredsysadmin.keeporg/internal/blob"
 	"cc.tiredsysadmin.keeporg/internal/kdbx"
 	"cc.tiredsysadmin.keeporg/internal/secret"
+	"cc.tiredsysadmin.keeporg/internal/sqldb"
 	"cc.tiredsysadmin.keeporg/internal/store"
 )

@@ -31,9 +34,19 @@ type Config struct {
 	TLSKey      string        `json:"tls_key,omitempty"`
 	OIDC        OIDCConfig    `json:"oidc"`

-	// MasterKeyFile holds the key that wraps the vault keys the server keeps
-	// in order to merge. It belongs outside DataDir: a copy of the data
-	// directory alone must not be enough to open a vault.
+	// TrustedProxies are the reverse proxies whose X-Forwarded-For is
+	// believed, as addresses or CIDR ranges. Rate limits count per client
+	// address, and behind a proxy every request otherwise comes from it.
+	TrustedProxies []string `json:"trusted_proxies,omitempty"`
+
+	// Database is where the server keeps its data: postgres://… for
+	// PostgreSQL, or sqlite:<path>. The default is a SQLite file in DataDir.
+	Database string `json:"database"`
+
+	// MasterKeyFile holds the key that encrypts everything in the database
+	// and wraps the vault keys the server keeps in order to merge. It belongs
+	// outside DataDir and outside the database's backups: either alone must
+	// not be enough to read anything.
 	MasterKeyFile string `json:"master_key_file"`
 	// VaultKDF is the work factor of vaults this server creates. The server
 	// pays it three times per merge, and so does every client on every open.
@@ -49,7 +62,12 @@ func (c *Config) Defaults() {
 		c.DataDir = "/var/lib/keeporg"
 	}
 	if c.ExternalURL == "" {
-		c.ExternalURL = "http://localhost" + c.Addr
+		// ":8765" means every interface; "127.0.0.1:8765" names its host.
+		host := c.Addr
+		if strings.HasPrefix(host, ":") {
+			host = "localhost" + host
+		}
+		c.ExternalURL = "http://" + host
 	}
 	c.ExternalURL = strings.TrimRight(c.ExternalURL, "/")
 	if c.SessionTTL == 0 {
@@ -58,6 +76,9 @@ func (c *Config) Defaults() {
 	if c.MaxDBSize == 0 {
 		c.MaxDBSize = 32 << 20
 	}
+	if c.Database == "" {
+		c.Database = "sqlite:" + filepath.Join(c.DataDir, "keeporg.db")
+	}
 	if c.MasterKeyFile == "" {
 		c.MasterKeyFile = "/etc/keeporg/master.key"
 	}
@@ -68,33 +89,42 @@ func (c *Config) Defaults() {

 type Server struct {
 	cfg     Config
+	db      *sqldb.DB
 	st      *store.Store
 	blobs   *blob.Store
 	hub     *Hub
 	oidc    *oidcProvider
 	keyring *secret.Keyring
+	limits  *limiter
+	proxies []*net.IPNet
+	merges  chan struct{} // a slot per merge allowed to run at once
 	mux     *http.ServeMux
 	log     *log.Logger
 }

-// New opens the server's data directory and wires up its routes.
+// New opens the server's database and wires up its routes.
 func New(cfg Config, lg *log.Logger) (*Server, error) {
 	cfg.Defaults()
-	st, err := store.Open(filepath.Join(cfg.DataDir, "state.json"))
+	proxies, err := parseProxies(cfg.TrustedProxies)
 	if err != nil {
 		return nil, err
 	}
-	blobs, err := blob.Open(filepath.Join(cfg.DataDir, "blobs"))
+	// Everything in the database is sealed under the master key, so there
+	// is no serving without it.
+	kr, err := secret.LoadKeyring(cfg.MasterKeyFile)
+	if err != nil {
+		return nil, fmt.Errorf("master key: %w", err)
+	}
+	st, db, err := OpenStore(cfg, kr)
 	if err != nil {
 		return nil, err
 	}
-	s := &Server{cfg: cfg, st: st, blobs: blobs, hub: NewHub(), mux: http.NewServeMux(), log: lg}
-	// Without a master key the server still serves every strategy that does
-	// not need to read a vault; only merging and vault creation are refused.
-	if kr, kerr := secret.LoadKeyring(cfg.MasterKeyFile); kerr != nil {
-		lg.Printf("no master key, so this server cannot create or merge vaults: %v", kerr)
-	} else {
-		s.keyring = kr
+	s := &Server{cfg: cfg, db: db, st: st, blobs: blob.Open(db, kr.Derive("blobs")),
+		keyring: kr, limits: newLimiter(), proxies: proxies, merges: make(chan struct{}, 2),
+		hub: NewHub(), mux: http.NewServeMux(), log: lg}
+	if err := s.importLegacy(); err != nil {
+		s.Close()
+		return nil, fmt.Errorf("import %s: %w", cfg.DataDir, err)
 	}
 	if cfg.OIDC.Enabled() {
 		s.oidc = newOIDCProvider(cfg.OIDC, cfg.ExternalURL+"/oidc/callback")
@@ -146,7 +176,30 @@ func (s *Server) Store() *store.Store { return s.st }
 func (s *Server) Config() Config { return s.cfg }

 // Handler is the server's HTTP entry point.
-func (s *Server) Handler() http.Handler { return s.mux }
+// Handler is the server's HTTP surface, with the security headers every
+// response carries.
+func (s *Server) Handler() http.Handler {
+	hsts := strings.HasPrefix(s.cfg.ExternalURL, "https://")
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		h := w.Header()
+		h.Set("X-Content-Type-Options", "nosniff")
+		h.Set("Referrer-Policy", "no-referrer")
+		// The pages have no scripts, no images and no frames; their only
+		// style is inline. Nothing may frame them, which is what stops a
+		// sign-out or delete button being clicked through a disguise.
+		h.Set("Content-Security-Policy", "default-src 'none'; style-src 'unsafe-inline'; "+
+			"form-action 'self'; frame-ancestors 'none'; base-uri 'none'")
+		h.Set("X-Frame-Options", "DENY")
+		h.Set("Cross-Origin-Opener-Policy", "same-origin")
+		// Pages carry CSRF tokens, invite links and, once, a TOTP secret;
+		// API answers carry bearer tokens. None of it belongs in a cache.
+		h.Set("Cache-Control", "no-store")
+		if hsts {
+			h.Set("Strict-Transport-Security", "max-age=63072000; includeSubDomains")
+		}
+		s.mux.ServeHTTP(w, r)
+	})
+}

 // StartHousekeeping runs periodic expiry until done is closed.
 func (s *Server) StartHousekeeping(done <-chan struct{}) {
@@ -215,6 +268,7 @@ func (s *Server) routes() {
 	m.HandleFunc("POST /invite/{token}", s.handleInviteRedeem)
 	m.HandleFunc("GET /oidc/login", s.handleOIDCLogin)
 	m.HandleFunc("GET /oidc/callback", s.handleOIDCCallback)
+	m.HandleFunc("POST /oidc/approve", s.handleOIDCApprove)

 	// Synchronization.
 	m.HandleFunc("GET /api/v1/databases", s.authed(s.handleListDatabases))
@@ -338,15 +392,34 @@ func (s *Server) markSeen(token string, last time.Time) {
 	})
 }

-// bearer extracts a token from the Authorization header, or from the
-// access_token query parameter, which EventSource clients need because they
-// cannot set headers.
+// bearer extracts a token from the Authorization header. The event stream
+// alone also takes ?access_token=, which clients before 0.12 sent; a token
+// in a URL ends up in proxy logs, so nothing else accepts it, and current
+// clients send the header there too.
 func bearer(r *http.Request) string {
 	h := r.Header.Get("Authorization")
 	if after, ok := strings.CutPrefix(h, "Bearer "); ok {
 		return strings.TrimSpace(after)
 	}
-	return r.URL.Query().Get("access_token")
+	if r.URL.Path == "/api/v1/events" {
+		return r.URL.Query().Get("access_token")
+	}
+	return ""
+}
+
+// sessionAlive reports whether a token still belongs to a live session of
+// an enabled account, for long requests that outlast their authentication.
+func (s *Server) sessionAlive(token string) bool {
+	alive := false
+	s.st.Read(func(st *store.State) {
+		sess := st.Sessions[token]
+		if sess == nil || time.Now().After(sess.ExpiresAt) {
+			return
+		}
+		u := st.Users[sess.UserID]
+		alive = u != nil && !u.Disabled
+	})
+	return alive
 }

 func (s *Server) newSession(st *store.State, userID, label string) *store.Session {