V4 Docs

# 🔑 Encryption

Chevereto uses ChaCha20 (opens new window) algorithm to cipher secrets and sensitive data. When enabled, Chevereto will store these values encrypted in the database.

Requires manual update

Encryption in Chevereto was added in v4.0.0-beta.10. If you installed Chevereto prior to this release you will require to manually enable encryption.

# What is encrypted?

# Settings secrets

The following settings are encrypted in the database:

Setting Key
API V1 key (public) api_v1_key
SMTP server (opens new window) email_smtp_server
SMTP port email_smtp_server_port
SMTP username (opens new window) email_smtp_server_username
SMTP password (opens new window) email_smtp_server_password
reCAPTCHA secret key (opens new window) recaptcha_private_key
Disqus secret key (opens new window) disqus_secret_key
Akismet API key (opens new window) akismet_api_key
ModerateContent API Key (opens new window) moderatecontent_key
Project Arachnid API Key (opens new window) arachnid_key
XR Debug Host (opens new window) xr_host
XR Debug Port (opens new window) xr_port
XR Debug Key xr_key

# Storage credentials

The following storage columns for chv_storages are encrypted in the database:

  • server
  • service
  • account_id
  • account_name
  • key
  • secret
  • bucket

# Two-factor secrets

Two-factor secret codes used to generate TOTP are encrypted in the database. Table chv_two_factors.

# Key

The encryption key is base64 encoded random string of size 32. To generate a key use openssl:

openssl rand -base64 32

# Key security

Handle the encryption key with the same discretion of a password.

  • The encryption key should remain private.
  • Don't re-use the same key in different installations.
  • Backup the key in a safe location.

# Enabling encryption

To enable encryption provide the CHEVERETO_ENCRYPTION_KEY environment variable.

ðŸŠķ This key is automatic provided when using HTTP setup, stored in the env.php file.

# From previous versions

Chevereto installations previous the introduction of encryption will require to manually cipher the existing data. This is a one time process that encrypts the plain text data stored in the database.

To manually enable encryption:

# Disabling encryption

When disabling encryption all the cipher texts stored in the database will be reverted to its plain text value.

To disable encryption:

← 😖 Errors →