mirror of https://github.com/usememos/memos
feat: implemented encryption at rest
Yi-Ting Chiu
3 weeks ago
parent
8d8cc83fd8
commit
719cae5a52
@ -1,11 +1,22 @@
|
||||
<!DOCTYPE html>
|
||||
<!doctype html>
|
||||
<html lang="en">
|
||||
<head>
|
||||
<meta charset="UTF-8" />
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
|
||||
<link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png" />
|
||||
<link rel="icon" type="image/webp" href="/logo.webp" />
|
||||
<link rel="manifest" href="/site.webmanifest" />
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=no" />
|
||||
<!-- memos.metadata.head -->
|
||||
<title>Memos</title>
|
||||
<script type="module" crossorigin src="/assets/index-D03I_urG.js"></script>
|
||||
<link rel="modulepreload" crossorigin href="/assets/utils-vendor-CZ4GW7MU.js">
|
||||
<link rel="modulepreload" crossorigin href="/assets/leaflet-vendor-DhA_n75-.js">
|
||||
<link rel="modulepreload" crossorigin href="/assets/mermaid-vendor-Be1fRuBG.js">
|
||||
<link rel="modulepreload" crossorigin href="/assets/katex-vendor-DsmCZfJr.js">
|
||||
<link rel="stylesheet" crossorigin href="/assets/index-CkcxhRdR.css">
|
||||
</head>
|
||||
<body>
|
||||
No embeddable frontend found.
|
||||
<body class="text-base w-full min-h-svh">
|
||||
<div id="root" class="relative w-full min-h-full"></div>
|
||||
<!-- memos.metadata.body -->
|
||||
</body>
|
||||
</html>
|
||||
|
||||
@ -0,0 +1,32 @@
|
||||
//go:build !memos_sqlcipher
|
||||
|
||||
package sqlite
|
||||
|
||||
import (
|
||||
"database/sql"
|
||||
|
||||
"github.com/pkg/errors"
|
||||
|
||||
"github.com/usememos/memos/internal/profile"
|
||||
|
||||
// Import the pure-Go SQLite driver.
|
||||
_ "modernc.org/sqlite"
|
||||
)
|
||||
|
||||
func openSQLiteDB(profile *profile.Profile) (*sql.DB, error) {
|
||||
if profile.SQLiteEncryptionKey != "" {
|
||||
return nil, errors.New("sqlite encryption key provided but binary is not built with SQLCipher support; rebuild with -tags memos_sqlcipher")
|
||||
}
|
||||
|
||||
sqliteDB, err := sql.Open(sqliteModernDriver, profile.DSN)
|
||||
if err != nil {
|
||||
return nil, errors.Wrapf(err, "failed to open db with dsn: %s", profile.DSN)
|
||||
}
|
||||
|
||||
if err := configureSQLiteConnection(sqliteDB); err != nil {
|
||||
sqliteDB.Close()
|
||||
return nil, err
|
||||
}
|
||||
|
||||
return sqliteDB, nil
|
||||
}
|
||||
@ -0,0 +1,49 @@
|
||||
//go:build memos_sqlcipher
|
||||
|
||||
package sqlite
|
||||
|
||||
import (
|
||||
"database/sql"
|
||||
"fmt"
|
||||
"strings"
|
||||
|
||||
"github.com/pkg/errors"
|
||||
|
||||
"github.com/usememos/memos/internal/profile"
|
||||
|
||||
// Import the CGO-backed SQLCipher-compatible SQLite driver.
|
||||
_ "github.com/mattn/go-sqlite3"
|
||||
)
|
||||
|
||||
func openSQLiteDB(profile *profile.Profile) (*sql.DB, error) {
|
||||
sqliteDB, err := sql.Open(sqliteCipherDriver, profile.DSN)
|
||||
if err != nil {
|
||||
return nil, errors.Wrapf(err, "failed to open db with dsn: %s", profile.DSN)
|
||||
}
|
||||
|
||||
if err := applySQLiteEncryptionKey(sqliteDB, profile.SQLiteEncryptionKey); err != nil {
|
||||
sqliteDB.Close()
|
||||
return nil, err
|
||||
}
|
||||
|
||||
if err := configureSQLiteConnection(sqliteDB); err != nil {
|
||||
sqliteDB.Close()
|
||||
return nil, err
|
||||
}
|
||||
|
||||
return sqliteDB, nil
|
||||
}
|
||||
|
||||
func applySQLiteEncryptionKey(db *sql.DB, key string) error {
|
||||
if key == "" {
|
||||
return nil
|
||||
}
|
||||
|
||||
escapedKey := strings.ReplaceAll(key, "'", "''")
|
||||
pragma := fmt.Sprintf("PRAGMA key = '%s'", escapedKey)
|
||||
if _, err := db.Exec(pragma); err != nil {
|
||||
return errors.Wrap(err, "failed to apply sqlite encryption key; verify the binary is linked against SQLCipher")
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
Loading…
Reference in New Issue