liuyu/nofx - nofx - Gitea: Git with a cup of tea

liuyu/nofx

Fork 0

mirror of https://github.com/NoFxAiOS/nofx.git synced 2026-07-02 18:41:01 +08:00

Commit Graph

Author	SHA1	Message	Date
ZhouYongyou	617f08c9c6	refactor(crypto): simplify to local encryption only (remove KMS) ## 🎯 簡化方案（社區友好） ### 移除雲端 KMS - ❌ 刪除 crypto/aliyun_kms.go - ❌ 不包含 GCP KMS - ✅ 僅保留本地 AES-256-GCM 加密 ### 更新 SQLite 驅動 - ✅ modernc.org/sqlite（純 Go，無 CGO） - ✅ 與上游保持一致 ## 📦 保留核心功能 ✅ crypto/encryption.go - RSA + AES 加密 ✅ crypto/secure_storage.go - 數據庫加密層 ✅ api/crypto_handler.go - API 端點 ✅ web/src/lib/crypto.ts - 前端加密 ✅ scripts/migrate_encryption.go - 數據遷移 ## 🚀 部署方式 ```bash # 僅需一個環境變量 export NOFX_MASTER_KEY=$(openssl rand -base64 32) go run main.go ``` ## ✅ 優點 - ✅ 零雲服務依賴 - ✅ 簡單易部署 - ✅ 適合社區用戶 - ✅ 保持核心安全功能	2025-11-06 23:58:27 +08:00
ZhouYongyou	8c575a0613	feat(security): add end-to-end encryption for sensitive data ## Summary Add comprehensive encryption system to protect private keys and API secrets. ## Core Components - `crypto/encryption.go`: RSA-4096 + AES-256-GCM encryption manager - `crypto/secure_storage.go`: Database encryption layer + audit logs - `crypto/aliyun_kms.go`: Optional Aliyun KMS integration - `api/crypto_handler.go`: Encryption API endpoints - `web/src/lib/crypto.ts`: Frontend two-stage encryption - `scripts/migrate_encryption.go`: Data migration tool - `deploy_encryption.sh`: One-click deployment ## Security Architecture ``` Frontend: Two-stage input + clipboard obfuscation ↓ Transport: RSA-4096 + AES-256-GCM hybrid encryption ↓ Storage: Database encryption + audit logs ``` ## Features ✅ Zero breaking changes (backward compatible) ✅ Automatic migration of existing data ✅ <25ms overhead per operation ✅ Complete audit trail ✅ Optional cloud KMS support ## Migration ```bash ./deploy_encryption.sh # 5 minutes, zero downtime ``` ## Testing ```bash go test ./crypto -v ``` Related-To: security-enhancement	2025-11-06 23:55:33 +08:00
zbhan	9a604f9b27	feat: pr validation	2025-11-01 18:25:44 -04:00

Author

SHA1

Message

Date

ZhouYongyou

617f08c9c6

refactor(crypto): simplify to local encryption only (remove KMS)

## 🎯 簡化方案（社區友好）

### 移除雲端 KMS
- ❌ 刪除 crypto/aliyun_kms.go
- ❌ 不包含 GCP KMS
- ✅ 僅保留本地 AES-256-GCM 加密

### 更新 SQLite 驅動
- ✅ modernc.org/sqlite（純 Go，無 CGO）
- ✅ 與上游保持一致

## 📦 保留核心功能

✅ crypto/encryption.go        - RSA + AES 加密
✅ crypto/secure_storage.go    - 數據庫加密層
✅ api/crypto_handler.go       - API 端點
✅ web/src/lib/crypto.ts       - 前端加密
✅ scripts/migrate_encryption.go - 數據遷移

## 🚀 部署方式

```bash
# 僅需一個環境變量
export NOFX_MASTER_KEY=$(openssl rand -base64 32)
go run main.go
```

## ✅ 優點

- ✅ 零雲服務依賴
- ✅ 簡單易部署
- ✅ 適合社區用戶
- ✅ 保持核心安全功能

2025-11-06 23:58:27 +08:00

ZhouYongyou

8c575a0613

feat(security): add end-to-end encryption for sensitive data

## Summary
Add comprehensive encryption system to protect private keys and API secrets.

## Core Components
- `crypto/encryption.go`: RSA-4096 + AES-256-GCM encryption manager
- `crypto/secure_storage.go`: Database encryption layer + audit logs
- `crypto/aliyun_kms.go`: Optional Aliyun KMS integration
- `api/crypto_handler.go`: Encryption API endpoints
- `web/src/lib/crypto.ts`: Frontend two-stage encryption
- `scripts/migrate_encryption.go`: Data migration tool
- `deploy_encryption.sh`: One-click deployment

## Security Architecture
```
Frontend: Two-stage input + clipboard obfuscation
    ↓
Transport: RSA-4096 + AES-256-GCM hybrid encryption
    ↓
Storage: Database encryption + audit logs
```

## Features
✅ Zero breaking changes (backward compatible)
✅ Automatic migration of existing data
✅ <25ms overhead per operation
✅ Complete audit trail
✅ Optional cloud KMS support

## Migration
```bash
./deploy_encryption.sh  # 5 minutes, zero downtime
```

## Testing
```bash
go test ./crypto -v
```

Related-To: security-enhancement

2025-11-06 23:55:33 +08:00

zbhan

9a604f9b27

feat: pr validation

2025-11-01 18:25:44 -04:00

3 Commits