Enable Server-Side Encryption

[ptruka]

Hello,

According to the OpenCloud documentation, files should be encrypted when stored on the server (Server-Side Encryption). However, when I inspect the backend filesystem directly, I can still access and open the files in plain text.

Is there a specific configuration setting I need to enable to activate this feature, or have I misunderstood how the encryption is implemented?

Thanks in advance

[Panxatony]

Do you use S3 or Posix? Encryption may only be available with S3 storage.

[micbar]

Correct. Encryption is only available with S3 Storage.

[mjnaderi]

Is there any documentation about enabling encryption for S3 storage? @Panxatony @micbar

[micbar]

not yet. @butonic @Svanvith @ScharfViktor Needs to be added

[butonic]

Documentation from the future ... Not implemented. Needs at least a new PutObject option:

// Create a new symmetric key
key := encrypt.NewSymmetricKey([]byte("my-secret-key-1234"))

// Create an SSE-C object from the key
encryption := encrypt.DefaultSSEC(key)

// Use SSE-C encryption for PutObject
_, err := minioClient.PutObject(context.Background(), bucketName, objectName, reader, objectSize, 
    minio.PutObjectOptions{
        ServerSideEncryption: encryption,
    })

// The same encryption object must be provided to download
object, err := minioClient.GetObject(context.Background(), bucketName, objectName,
    minio.GetObjectOptions{
        ServerSideEncryption: encryption,
    })

See https://deepwiki.com/minio/minio-go/5.4-server-side-encryption and https://github.com/minio/minio-go/blob/3e647dd9/docs/API.md#L447-L447

Our related code lives in: https://github.com/opencloud-eu/reva/blob/15373fbb74f73a2ccaeb7d9a7e6012d6a67d3342/pkg/storage/fs/decomposeds3/blobstore/blobstore.go#L87-L95

[mjnaderi]

To have encrypted data on S3 bucket, I used JuiceFS with data encryption and connected OpenCloud's DecomposedS3 storage to JuiceFS's S3 gateway. So far so good. I also enabled compression and local cache in JuiceFS.

[throny]

While I really like the experience so far and think that OpenCloud is super promising, I had a similar experience to @ptruka. I was actually surprised when I noticed during the backup process that the data was not encrypted.
When the docs says "Files are encrypted automatically when stored on the server." I just assumed, there is some magic happening.
That being said, I think the docs are at least misleading/not clear enough or even contradictory.
I don't think this should be advertised as a feature like this if it's not even implemented/documented yet and would only apply to S3. Promoting non-existent features on the landing page is bad practice imho.

[tbsbdr]

thanks @throny I corrected it: opencloud-eu/docs#640

[Svanvith]

Thanks for the hint. We correct the description https://docs.opencloud.eu/docs/next/admin/features/#s3-server-side-encryption