Storage. The server keeps its data in SQLite (a file in the data
directory, the default) or PostgreSQL (database, KEEPORG_DATABASE_URL or
-database). Every row, the KDBX versions included, is sealed with
AES-256-GCM under a key derived from the master key and named by an HMAC.
The master key is required to start and a different one is refused. A data
directory from 0.10 or earlier is imported on first start. Several servers
may share one PostgreSQL database. Go goes to 1.26 for the pure-Go
drivers (modernc.org/sqlite, jackc/pgx).
Hardening, after an audit of the server, both clients and the deployment:
- Single sign-on approves a device only after an explicit Approve in the
browser that started it, bound by a cookie and PKCE; identities are never
linked by username, by verified email only when allowed, never to admins.
- Sign-in attempts are limited per address and per account, passwords are
checked outside the store lock with uniform timing, one-time codes work
once, and starting two-factor needs the password.
- Merge vaults bound KDF parameters, payload size and XML shape, check
pushes before storing them, and run at most two merges at once. A version
is written in the same transaction as its metadata.
- Tokens in URLs only on the event stream, which ends on revocation; CSP,
frame-ancestors, no-store and HSTS; sign-in CSRF; 404 for databases
without access; new trusted_proxies.
- Clients open only the server's approval page, keep case-variant and
retired file names apart, never overwrite a save made during a pull,
require https except locally, send the stream token in a header, bound
their reads and escape notifications and terminal output.
- The .deb creates the master key, systemd is sandboxed further, nginx sets
modern TLS and HSTS, and CI deploys from main only.
Server 0.12.0, desktop 0.6.0, Android 0.4.0 (versionCode 4).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The deploy pipeline watched a VERSION file that does not exist, so a
version bump built the image but never deployed it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Two things in the deploy did not do what they looked like:
build-server passed --build-arg APP_VERSION, but the Dockerfile declares
ARG VERSION. An unknown build arg is ignored with a warning, so every
deployed image was stamped "dev": `keeporgd -version` and the image's
version label both said so, whatever the tag claimed.
The build pipeline's path filter listed 'VERSION', a file this repository
does not have, and '*.go', which under doublestar matches only top-level
Go files, of which there are none. So a push that changed only Go code or
only the version did not trigger a build. Now versions.mk and '**/*.go'.
Proved: built with --build-arg VERSION=0.5.0 and ran -version in the
container, which now reports 0.5.0.
root