# feat: Enforcing Database Encryption & Enable HTTPS by default

[groundmuffin]

feat: Enforcing Database Encryption & Enable HTTPS by default

This pull request introduces a set of security enhancements to the Fasten-on-prem application. This implementation ensures that all sensitive data stored in the database is encrypted, and that all communication with the server is secured with HTTPS by default.

Key Features and Changes

1. HTTPS by Default

• The application now runs on https://localhost:9090 by default, with HTTPS enabled in the configuration.
• An automatic self-signed TLS certificate generation mechanism creates a local Certificate Authority (CA) to issue a server certificate, ensuring the user's connection is secure out-of-the-box.

2. Automatic Encryption Key Generation

• On the first run of the application, a unique encryption key is automatically generated for the database.
• This key is essential for accessing the database and must be saved by the user in a secure location.

3. Startup and Standby Mode

• The application now includes a startup check to determine if the database is encrypted and if the encryption key is available.
• If the encryption key is missing, the application will start in a "standby mode." In this mode, most of the application's functionality is disabled, and the user is prompted to provide the encryption key to proceed.

4. Backend Refactoring

• Configuration: The config.yaml file has been updated to include an encryption.enabled flag (default true) and settings for enabling HTTPS and managing certificate directories.
• Encryption Key Handling: New handlers and services have been added to the backend to manage the encryption key, including endpoints for retrieving, setting, and validating the key.
• Database Initialization: The database repository has been refactored to support encryption using SQLCipher.
• Web Server: The web server has been updated to start with ListenAndServeTLS when HTTPS is enabled, using the generated certificates.

5. Frontend User Experience

• Encryption Key Wizard: A new wizard guides users through saving their encryption key during the initial setup.
• Restore Encryption Key: A dedicated page allows users to restore their encryption key if the application is in standby mode.
• Route Guards: New route guards ensure that the application is only accessible when the encryption key is present and valid.
• Proxy Configuration: The frontend proxy has been updated to ensure proper communication with the HTTPS backend during local development.

6. Updated Documentation

• The README.md file has been updated with detailed instructions on how to trust the self-signed root CA certificate on macOS, Windows, and Linux, as well as in Firefox.

How to Test

1. Trusting the Self-Signed Certificate:

   • Before starting the application, ensure you have a certs directory.
   • Start the application. It will generate a rootCA.pem file in the certs directory.
   • Follow the instructions below to import the certificate into your operating system or browser:
     • macOS: Open Keychain Access, select the System keychain, and import the certs/rootCA.pem file. Set the "Fasten Health CA" certificate to Always Trust.
     • Windows: Double-click the certs/rootCA.pem file, install the certificate to the Local Machine, and place it in the Trusted Root Certification Authorities store.
     • Linux (Ubuntu/Debian): Copy the certificate to /usr/local/share/ca-certificates/fasten-health-ca.crt and run sudo update-ca-certificates.
     • Firefox: Go to Settings > Privacy & Security > Certificates > View Certificates..., import the certs/rootCA.pem file in the Authorities tab, and trust it to identify websites.

2. First-Time Setup:

   • With the application running, you should be redirected to the encryption key wizard.
   • Follow the instructions to save your encryption key.
   • Once the key is saved, you should be able to proceed with the normal application setup.

3. Restoring from Standby Mode:

   • Stop the application.
   • Start the application again.
   • You should be redirected to the "Restore Encryption Key" page.
   • Enter your saved encryption key to regain access to the application.

These changes significantly improve the security of the Fasten-on-prem application by ensuring that all user data is encrypted at rest and all data transmitted is secure, providing a safer experience for users.

---

Quick demos:

• Trusting CA certificate

trust-ca.mp4

• Managing DB enryption key

db-enc.mp4