9e29e7b330
* feat(security): encrypt server-owned credentials at rest Introduce AES-256-GCM at-rest encryption (HKDF-derived from a required SECRET_KEY) for server-owned credentials, with row-bound AAD, a versioned enc:v1: envelope, and an idempotent startup backfill. - internal/secret: cipher + RowAAD/SettingsAAD + the startup backfill engine. - SECRET_KEY required at bootstrap; cipher threaded as an explicit dependency. - server_settings: EncryptedSettingsRepo decorator over the audited SensitiveSettingKeys (also drives admin redaction); the config watcher and watch-sync settings reads decrypt too. - Arr keys inline-encrypted; the ambiguous SecretResolver indirection removed from requests/autoscan. - Per-table columns encrypted: subtitles, watch-sync, webhook-sync (not webhook_secret), history-import, and the jellycompat session's bridged Silo access/refresh tokens. - Startup backfill (resolve-then-encrypt for arr refs) is best-effort and primary-node gated. Equality-looked-up secrets and plugin_runtime_configs.config_value are out of scope (need hashing / cross-repo design) — see docs/architecture/secret-encryption.md. Refs #45 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * chore(compose): require SECRET_KEY in docker-compose The server now fatals without SECRET_KEY, so the integrated service (and the commented distributed proxy/transcode examples) pass it through with a fail-fast guard matching the existing MEDIA_ROOT pattern. Distributed worker nodes must use the SAME key as the primary to decrypt shared data. Generate with: openssl rand -base64 48. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(security): encrypt history import session credentials --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
75 lines
2.8 KiB
Bash
75 lines
2.8 KiB
Bash
# Silo Docker deployment
|
|
# For the default docker compose setup, MEDIA_ROOT is the main value you need to set.
|
|
|
|
# Optional: layer compose files through env. Leave unset for CPU-only defaults.
|
|
# Linux/macOS example for enabling NVIDIA override:
|
|
# COMPOSE_FILE=docker-compose.yml:docker-compose.nvidia.yml
|
|
# Windows example:
|
|
# COMPOSE_FILE=docker-compose.yml;docker-compose.nvidia.yml
|
|
|
|
# Required for docker compose: host path to your media library.
|
|
# Example: MEDIA_ROOT=/srv/media
|
|
MEDIA_ROOT=/srv/media
|
|
|
|
# Container path where Silo sees MEDIA_ROOT. New installs can keep /mnt/media.
|
|
# Continuum migrations should set this to the old in-container library path if
|
|
# existing library records use that path.
|
|
MEDIA_CONTAINER_ROOT=/mnt/media
|
|
|
|
# Recommended server data root for bind mounts.
|
|
SILO_DATA_ROOT=/opt/silo
|
|
|
|
# Published application image. Override to pin a specific tag if needed.
|
|
SILO_IMAGE=ghcr.io/silo-server/silo-server:latest
|
|
|
|
# Quick-start bundled PostgreSQL settings used by docker-compose.yml.
|
|
POSTGRES_USER=silo
|
|
POSTGRES_PASSWORD=silo
|
|
POSTGRES_DB=silo
|
|
POSTGRES_SHM_SIZE=8gb
|
|
|
|
# PostgreSQL auto-tuning is enabled by default in docker-compose.yml. Silo
|
|
# applies pgtune-style OLTP recommendations through ALTER SYSTEM at startup.
|
|
# Set POSTGRES_TUNE=off if you manage PostgreSQL tuning yourself.
|
|
# POSTGRES_TUNE=off
|
|
# POSTGRES_TUNE_PROFILE=oltp
|
|
# POSTGRES_TUNE_MEMORY=auto
|
|
# POSTGRES_TUNE_MEMORY_BUDGET_PERCENT=75
|
|
# POSTGRES_TUNE_CPUS=auto
|
|
# POSTGRES_TUNE_STORAGE=ssd
|
|
# POSTGRES_TUNE_DB_SIZE=auto
|
|
# POSTGRES_TUNE_CONNECTIONS=100
|
|
|
|
# Optional host port overrides for docker-compose.yml.
|
|
# PORT=8090
|
|
# JF_PORT=8096
|
|
# PROXY_PORT=8083
|
|
# TRANSCODE_PORT=8082
|
|
|
|
# Optional NVIDIA override controls (used by docker-compose.nvidia.yml).
|
|
# NVIDIA_GPU_COUNT=1
|
|
|
|
# REQUIRED: master key for at-rest credential encryption. Silo refuses to start
|
|
# without it. Integration API keys, S3 keys, and other server-owned secrets are
|
|
# encrypted under a key derived from this value, so it must be at least 32
|
|
# characters and kept secret. Generate one with:
|
|
# openssl rand -base64 48
|
|
# Back it up SEPARATELY from your database dumps (treat it like a CA private
|
|
# key): losing it makes every encrypted secret unrecoverable. See
|
|
# docs/architecture/secret-encryption.md.
|
|
# SECRET_KEY=replace-with-output-of-openssl-rand-base64-48
|
|
|
|
# Run from source / advanced overrides
|
|
# Only DATABASE_URL is required when running Silo outside the default docker compose stack.
|
|
# DATABASE_URL=postgres://silo:password@localhost:5432/silo
|
|
|
|
# Optional Redis override when running from source or pointing workers at an external Redis.
|
|
# REDIS_URL=redis://localhost:6379
|
|
|
|
# Optional standalone worker identity settings for docker-compose.remote-transcode.yml.
|
|
# NODE_NAME=transcode-01
|
|
# NODE_URL=http://transcode-01.example.com:8082
|
|
|
|
# Optional server mode override for source runs or standalone worker nodes.
|
|
# MODE=integrated
|