mirror of
https://github.com/narrrl/narl-workspace.git
synced 2026-11-03 16:41:27 +01:00
nvrl
7f8d625a8d
A `!` now means force or everything and nothing else (`:w!`, `:search!`, `:export!`, `:logout!`). A command that did a second thing behind its bang takes a word for it instead: `:space new|name|rm`, `:list name|rm`, `:task [add]|edit`, `:upload seal`, `:import zip [/]`. `:card` while reading a document makes a card about it, so `:card!` is gone. Merged: `:export` downloads what has focus, a file as it is or a document as markdown (`:download` folded in); `:share [off|new]` replaces `:unshare` and `:link`, and the list's `s` and `y` give way to it and the info sheet; `:noh` replaces `:clear`; `:vault [unlock|lock|passwd]` replaces `:unlock`, `:lock` and `:passwd`; Esc in the list puts down what `m` picked up before it closes the document, replacing `:unmark`. The old spellings run as their new lines for one release through a table in commands.ts; help and Tab leave them out, and the wiki lists them. A settings sheet (`,` or `:settings`) holds the options, the vault, the backup, the signed-in browsers, ssh keys and capture tokens. Each row runs the command a line would. Bare `:set`, `:vault`, `:backup`, `:sessions`, `:sshkey` and `:token` open it at their part. `?` shows the keys and commands to start with, flagged in the keymap and the command table; a second `?` (or `:help all`) shows all of them, and a filter always searches all of them. Help rows are keyed by key and description, as two contexts can share a label.
74 lines
3.4 KiB
Markdown
74 lines
3.4 KiB
Markdown
# The vault
|
|
|
|
Some files deserve more than the login: scans of documents, contracts, health
|
|
records. The vault encrypts them at rest under a password of their own. They
|
|
stay unreadable to anyone without it: someone with a copy of the data directory
|
|
or the Proton account the mirror writes to, and even a logged-in browser while
|
|
the vault is shut.
|
|
|
|
> **There is no recovery.** Forget the vault password and every sealed file is
|
|
> gone, from the server and from every backup. The password is not in `.env`,
|
|
> not in `diary.db` and not in the mirror.
|
|
|
|
## Using it
|
|
|
|
| command | what it does |
|
|
| --- | --- |
|
|
| `:vault` | set the password the first time (ten characters at least); afterwards, the vault in the settings sheet (`,`), where `Enter` opens or locks it |
|
|
| `:vault unlock` / `:vault lock` | open / close the vault |
|
|
| `:upload seal` | upload files sealed, encrypted as they stream in, so the plaintext never touches the disk |
|
|
| `:encrypt` | seal the file under the cursor; on a folder or space, seal it for good |
|
|
| `:decrypt` | take the file, or the sealed folder, back out |
|
|
| `:vault passwd` | change the password |
|
|
|
|
A sealed file carries a lock in the list, and the bar says `vault open` while it
|
|
is. While the vault is shut, `Enter` on a sealed file asks for the password.
|
|
|
|
## Sealed folders
|
|
|
|
`:encrypt` on a folder or a space seals it for good: every file in it now, and
|
|
every file that lands in it later. An upload, an import, an SFTP write and a
|
|
file moved in are all sealed on the way in. While the vault is shut they are
|
|
refused rather than stored readable. Folders made inside are sealed too.
|
|
`:decrypt` on the folder unseals it with everything in it.
|
|
|
|
Documents are not files and stay readable. Only the bytes of files are sealed;
|
|
the names of sealed files, and the documents around them, are as readable in
|
|
`diary.db` as everything else.
|
|
|
|
## When it closes
|
|
|
|
The vault closes itself after `WORKSPACE_VAULT_IDLE_MIN` minutes with nobody
|
|
using it (15 by default), on logout, and whenever the server restarts. The key
|
|
is dropped from memory then. While it is shut:
|
|
|
|
- a sealed file shows as sealed and nothing more;
|
|
- a share link never serves one, open or not;
|
|
- `:export!` refuses.
|
|
|
|
A sealed file is served with `Cache-Control: no-store`, so the browser keeps no
|
|
copy once the vault shuts. A sealed file is never indexed for search.
|
|
|
|
## Changing the password
|
|
|
|
`:vault passwd` makes a new master key as well as a new password. The old password
|
|
stops opening anything at once. Every sealed file is then sealed again under the
|
|
new key in the background while the vault is open; `:vault` shows how far it
|
|
has come. After that, an old copy of `diary.db` together with the old password
|
|
opens nothing still kept anywhere.
|
|
|
|
## How it works
|
|
|
|
Argon2id turns the password into a key that seals a random master key; only
|
|
that sealed copy is stored. Each file has a random key of its own, sealed under
|
|
the master key in the file's header together with the file's id. Its bytes are
|
|
AES-256-GCM in 64 KiB records, the last one marked as last, so a file that is
|
|
swapped, cut short or changed refuses to open.
|
|
|
|
Sealing an existing file writes it again under a new id, rewrites the documents
|
|
that embed it, and deletes the plaintext from the disk and from Proton Drive.
|
|
|
|
Over the [SFTP mount](SFTP.md), a key reads sealed files only once it has been
|
|
given vault access with `:sshkey vault <name> on`, and only while the vault is
|
|
open in a browser.
|