ReactorcoremeltdownandClaude Opus 5.5
4ffc434b1b
Storage. The server keeps its data in SQLite (a file in the data directory, the default) or PostgreSQL (database, KEEPORG_DATABASE_URL or -database). Every row, the KDBX versions included, is sealed with AES-256-GCM under a key derived from the master key and named by an HMAC. The master key is required to start and a different one is refused. A data directory from 0.10 or earlier is imported on first start. Several servers may share one PostgreSQL database. Go goes to 1.26 for the pure-Go drivers (modernc.org/sqlite, jackc/pgx). Hardening, after an audit of the server, both clients and the deployment: - Single sign-on approves a device only after an explicit Approve in the browser that started it, bound by a cookie and PKCE; identities are never linked by username, by verified email only when allowed, never to admins. - Sign-in attempts are limited per address and per account, passwords are checked outside the store lock with uniform timing, one-time codes work once, and starting two-factor needs the password. - Merge vaults bound KDF parameters, payload size and XML shape, check pushes before storing them, and run at most two merges at once. A version is written in the same transaction as its metadata. - Tokens in URLs only on the event stream, which ends on revocation; CSP, frame-ancestors, no-store and HSTS; sign-in CSRF; 404 for databases without access; new trusted_proxies. - Clients open only the server's approval page, keep case-variant and retired file names apart, never overwrite a save made during a pull, require https except locally, send the stream token in a header, bound their reads and escape notifications and terminal output. - The .deb creates the master key, systemd is sandboxed further, nginx sets modern TLS and HSTS, and CI deploys from main only. Server 0.12.0, desktop 0.6.0, Android 0.4.0 (versionCode 4). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
102 lines
3.3 KiB
Go
102 lines
3.3 KiB
Go
package server
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"fmt"
|
|
"io/fs"
|
|
"os"
|
|
"path/filepath"
|
|
"time"
|
|
|
|
"cc.tiredsysadmin.keeporg/internal/secret"
|
|
"cc.tiredsysadmin.keeporg/internal/sqldb"
|
|
"cc.tiredsysadmin.keeporg/internal/store"
|
|
)
|
|
|
|
// OpenStore opens the configured database, proves the master key is the one
|
|
// it was written with, and loads the metadata. keeporgd -reset-admin uses it
|
|
// too, so a reset goes through the same checks as the server.
|
|
func OpenStore(cfg Config, kr *secret.Keyring) (*store.Store, *sqldb.DB, error) {
|
|
cfg.Defaults()
|
|
ctx, cancel := context.WithTimeout(context.Background(), time.Minute)
|
|
defer cancel()
|
|
db, err := sqldb.Open(ctx, cfg.Database)
|
|
if err != nil {
|
|
return nil, nil, err
|
|
}
|
|
if err := db.CheckKey(ctx, kr.Derive("check")); err != nil {
|
|
db.Close()
|
|
return nil, nil, fmt.Errorf("database %s: %w", db.Where, err)
|
|
}
|
|
st, err := store.Open(ctx, db, kr.Derive("records"))
|
|
if err != nil {
|
|
db.Close()
|
|
return nil, nil, fmt.Errorf("database %s: %w", db.Where, err)
|
|
}
|
|
return st, db, nil
|
|
}
|
|
|
|
// Close stops the store's watcher and closes the database.
|
|
func (s *Server) Close() {
|
|
s.st.Close()
|
|
s.db.Close()
|
|
}
|
|
|
|
// legacyState and legacyBlobs are where servers before 0.11 kept everything,
|
|
// in the data directory.
|
|
const (
|
|
legacyState = "state.json"
|
|
legacyBlobs = "blobs"
|
|
)
|
|
|
|
// importLegacy moves the data of a server from before 0.11 into the
|
|
// database, once: when the database is empty and the old files are there.
|
|
// The payloads go first and the metadata last, in one transaction, so a
|
|
// crash part-way leaves an empty store and the import simply runs again.
|
|
//
|
|
// The old files are renamed rather than deleted, so nothing is lost if the
|
|
// import turns out wrong. They are not encrypted the way the database is —
|
|
// state.json holds session tokens in the clear — so the log asks for them to
|
|
// be deleted once the server is known to work.
|
|
func (s *Server) importLegacy() error {
|
|
statePath := filepath.Join(s.cfg.DataDir, legacyState)
|
|
if _, err := os.Stat(statePath); errors.Is(err, fs.ErrNotExist) {
|
|
return nil
|
|
}
|
|
if !s.st.Empty() {
|
|
s.log.Printf("WARNING: %s is still there, but the database already holds data, "+
|
|
"so it was not imported again. Delete it, and %s, once you no longer need them.",
|
|
statePath, filepath.Join(s.cfg.DataDir, legacyBlobs))
|
|
return nil
|
|
}
|
|
old, err := store.ReadLegacy(statePath)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
n, err := s.blobs.ImportDir(filepath.Join(s.cfg.DataDir, legacyBlobs))
|
|
if err != nil {
|
|
return err
|
|
}
|
|
if err := s.st.Replace(old); err != nil {
|
|
return err
|
|
}
|
|
stamp := time.Now().UTC().Format("20060102-150405")
|
|
var renamed []string
|
|
for _, name := range []string{legacyState, legacyBlobs} {
|
|
from := filepath.Join(s.cfg.DataDir, name)
|
|
to := from + ".imported-" + stamp
|
|
if err := os.Rename(from, to); err == nil {
|
|
renamed = append(renamed, to)
|
|
}
|
|
}
|
|
s.log.Printf("imported %d accounts, %d databases and %d stored versions from %s into %s",
|
|
len(old.Users), len(old.Databases), n, s.cfg.DataDir, s.db.Where)
|
|
s.log.Printf("the old files were kept as %v. They are not encrypted like the database "+
|
|
"(state.json holds session tokens): delete them once this server works", renamed)
|
|
return nil
|
|
}
|
|
|
|
// DatabaseWhere is the database's location without any password, for logs.
|
|
func (s *Server) DatabaseWhere() string { return s.db.Where }
|