Marc-André Bombeck 308470f229 feat(encryption): back up the key, and refuse to serve when it cannot open the database ...

Every configured key id now has a canary in encryption_key_canaries,
checked at boot. A key that cannot open its canary, or existing data
written before the canary existed, puts the process in a refusal state:
every API route answers 503 encryption.key_mismatch, /api/health reports
reason encryption_key_mismatch, the pages render one explanation, and
neither the queue producer nor the worker starts. The process stays up
so the reason is visible instead of hiding in a crash loop.

The admin Encryption page gains a "Back up your encryption key" step:
key id and fingerprint (never the key), where the key lives per
platform, a check of a pasted copy that is compared and discarded, and
a confirmation bound to the active key id and fingerprint. The overview
gets a tile and admins get a dashboard banner while it is due.

HEALTHLOG_PLATFORM picks the platform the step opens on. Adds the
TrueNAS self-hosting page and key backup sections in the docs.

2026-10-03 18:06:28 +02:00

..

__tests__

feat(security): encrypt medication free-text notes at rest + password-change MFA step-up

2026-06-28 03:05:10 +02:00

event-loop-lag.ts

feat(observability): every wide event carries the recent event-loop lag

2026-06-12 20:58:30 +02:00

redact-payload.ts

feat(encryption): back up the key, and refuse to serve when it cannot open the database

2026-10-03 18:06:28 +02:00