Uh oh!
There was an error while loading.Please reload this page.
- Notifications
You must be signed in to change notification settings - Fork1.9k
feat: add S3 backup encryption at rest using rclone crypt#3194
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.
Already on GitHub?Sign in to your account
Open
amirhmoradi wants to merge7 commits intoDokploy:canaryChoose a base branch fromamirhmoradi:claude/add-s3-backup-encryption-018RrZGgmyuupd7qWBRNYgCg
base:canary
Could not load branches
Branch not found:{{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline, and old review comments may become outdated.
Open
feat: add S3 backup encryption at rest using rclone crypt#3194
amirhmoradi wants to merge7 commits intoDokploy:canaryfromamirhmoradi:claude/add-s3-backup-encryption-018RrZGgmyuupd7qWBRNYgCg
Uh oh!
There was an error while loading.Please reload this page.
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.Learn more about bidirectional Unicode characters
Add support for encrypting backups before uploading to S3 and decryptingduring restore. This includes:- Database schema changes: - Added encryptionEnabled, encryptionMethod, and encryptionKey fields to the destination table - Created migration 0130_add_destination_encryption.sql- Server-side backup encryption: - Added getEncryptionCommand/getDecryptionCommand utilities - Updated all backup handlers (postgres, mysql, mariadb, mongo, compose, web-server) to encrypt backups when enabled - Encrypted backups have .enc extension appended- Server-side restore decryption: - Updated all restore handlers to detect encrypted backups and decrypt them during restore - Added isEncryptedBackup utility to check file extensions- UI changes: - Added encryption settings section to destination configuration - Toggle for enabling/disabling encryption - Dropdown for selecting encryption method (AES-256-CBC, AES-256-GCM) - Input for encryption key with generate button - Warning about storing keys securelyEncryption uses OpenSSL with PBKDF2 key derivation (100,000 iterations)for secure password-based encryption.
Replace OpenSSL-based encryption with rclone's native crypt backendfor better integration and simpler architecture. The crypt backendprovides transparent encryption/decryption using NaCl SecretBox(XSalsa20 cipher + Poly1305 for integrity).Changes:- Remove encryptionMethod field (rclone uses its own algorithm)- Add getRcloneS3Remote() to generate crypt-wrapped remotes- Simplify backup commands (encryption handled by rclone remote)- Simplify restore commands (decryption happens automatically)- Update UI to remove encryption method selection- Simplify migration to only add encryptionEnabled and encryptionKey
Add all rclone crypt configuration options to give users complete controlover backup encryption settings:New options:- password2: Optional salt password for additional security (recommended)- filenameEncryption: "standard", "obfuscate", or "off" (default: off)- directoryNameEncryption: Encrypt directory names when filename encryption is enabledUI improvements:- Added link to rclone crypt documentation- Password and salt password fields with generate buttons- Filename encryption dropdown with descriptions- Directory name encryption toggle (shown when filename encryption is enabled)Encryption details:- Uses NaCl SecretBox (XSalsa20 cipher + Poly1305)- Filename encryption uses EME for "standard" mode- All passwords should be stored securely as they cannot be recoveredSee:https://rclone.org/crypt/
Add comprehensive tests for getEncryptionConfigFromDestination andgetRcloneS3Remote functions covering all encryption options includingpassword2 (salt), filename encryption, and directory name encryption.
Resolved conflict in drizzle migration journal by renamingencryption migration from 0130 to 0131.
Update volume backup, restore, and cleanup functions to usegetRcloneS3Remote with encryption support. Volume backups nowrespect the destination's encryption settings (encryptionEnabled,encryptionKey, password2, filenameEncryption, directoryNameEncryption)just like database backups.
Author
amirhmoradi commentedDec 16, 2025
@Siumauricio Hi, thanks for the effort on Dokploy. I can see the that you are busy with the important number of commits and PRs on dokploy. Sorry to be bothering, any chance I get a feedback on my PRs in the coming weeks please? Is there a way for me to be more helpful on this project? |
Sign up for freeto join this conversation on GitHub. Already have an account?Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR adds encryption at rest support for all S3 backups using rclone's native crypt backend. When enabled on a destination, all backups (database, compose, web-server, and volume backups) are automatically encrypted before upload and decrypted on restore.
Key Features
Backup Types Covered
Files Changed
getRcloneS3Remote()function with crypt overlay support0131_add_destination_encryption.sqlHow It Works
Security
Test plan
Screenshots
The UI adds an "Encryption Settings" section to the destination form with:
Documentation:https://rclone.org/crypt/