Enable Server-Side Encryption

[ptruka]

Hello,

According to the OpenCloud documentation, files should be encrypted when stored on the server (Server-Side Encryption). However, when I inspect the backend filesystem directly, I can still access and open the files in plain text.

Is there a specific configuration setting I need to enable to activate this feature, or have I misunderstood how the encryption is implemented?

Thanks in advance

[Panxatony]

Do you use S3 or Posix? Encryption may only be available with S3 storage.

[micbar]

Correct. Encryption is only available with S3 Storage.

[mjnaderi]

Is there any documentation about enabling encryption for S3 storage? @Panxatony @micbar

[micbar]

not yet. @butonic @Svanvith @ScharfViktor Needs to be added

[butonic]

Documentation from the future ... Not implemented. Needs at least a new PutObject option:

// Create a new symmetric key
key := encrypt.NewSymmetricKey([]byte("my-secret-key-1234"))

// Create an SSE-C object from the key
encryption := encrypt.DefaultSSEC(key)

// Use SSE-C encryption for PutObject
_, err := minioClient.PutObject(context.Background(), bucketName, objectName, reader, objectSize, 
    minio.PutObjectOptions{
        ServerSideEncryption: encryption,
    })

// The same encryption object must be provided to download
object, err := minioClient.GetObject(context.Background(), bucketName, objectName,
    minio.GetObjectOptions{
        ServerSideEncryption: encryption,
    })

See https://deepwiki.com/minio/minio-go/5.4-server-side-encryption and https://github.com/minio/minio-go/blob/3e647dd9/docs/API.md#L447-L447

Our related code lives in: https://github.com/opencloud-eu/reva/blob/15373fbb74f73a2ccaeb7d9a7e6012d6a67d3342/pkg/storage/fs/decomposeds3/blobstore/blobstore.go#L87-L95

[mjnaderi]

To have encrypted data on S3 bucket, I used JuiceFS with data encryption and connected OpenCloud's DecomposedS3 storage to JuiceFS's S3 gateway. So far so good. I also enabled compression and local cache in JuiceFS.