sysopsandClaude Sonnet 4.6
46096db802
storage.loadKey() startet bei fehlendem/unlesbarem/ungültigem Keyfile weiterhin unverschlüsselt (kein Hard-Fail), aber: - einmalige WARN-Logzeile beim Start mit konkretem Grund - neuer Healthcheck-Prüfpunkt "Encryption" in archivmail status - Dashboard-API liefert encryption.enabled - README: GoBD-Hinweis zu storage.keyfile Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
46 lines
1.6 KiB
Go
46 lines
1.6 KiB
Go
package main
|
||
|
||
import (
|
||
"encoding/base64"
|
||
"log/slog"
|
||
"os"
|
||
"strings"
|
||
)
|
||
|
||
// warnEncryptionStatus emits a single, clearly visible WARN log line at startup
|
||
// when the at-rest mail storage is not AES-256-encrypted (PROJ-49).
|
||
//
|
||
// It does not change the (backwards-compatible) behaviour of storage.loadKey():
|
||
// the service starts regardless. It only increases visibility so operators do
|
||
// not silently archive unencrypted mails on a GoBD installation.
|
||
//
|
||
// enabled is the result of (*storage.Store).EncryptionEnabled(); keyfile is the
|
||
// configured path (may be empty). When encryption is disabled the keyfile is
|
||
// inspected to log a concrete reason (missing path, unreadable file, wrong size).
|
||
func warnEncryptionStatus(logger *slog.Logger, keyfile string, enabled bool) {
|
||
if enabled {
|
||
logger.Info("Speicherverschlüsselung aktiv (AES-256-GCM at-rest)", "keyfile", keyfile)
|
||
return
|
||
}
|
||
|
||
switch {
|
||
case strings.TrimSpace(keyfile) == "":
|
||
logger.Warn("WARNUNG: Keine Verschlüsselung konfiguriert – E-Mail-Speicher ist NICHT AES-256-verschlüsselt. " +
|
||
"Für GoBD-konforme produktive Installationen storage.keyfile setzen.")
|
||
default:
|
||
data, err := os.ReadFile(keyfile)
|
||
if err != nil {
|
||
logger.Warn("WARNUNG: Keyfile nicht lesbar – E-Mail-Speicher ist NICHT AES-256-verschlüsselt",
|
||
"keyfile", keyfile, "err", err)
|
||
return
|
||
}
|
||
raw := strings.TrimSpace(string(data))
|
||
decoded, derr := base64.StdEncoding.DecodeString(raw)
|
||
if derr != nil {
|
||
decoded = []byte(raw)
|
||
}
|
||
logger.Warn("WARNUNG: Ungültiges Keyfile (≠ 32 Byte) – E-Mail-Speicher ist NICHT AES-256-verschlüsselt",
|
||
"keyfile", keyfile, "bytes", len(decoded), "expected", 32)
|
||
}
|
||
}
|