Security, backup and upgrades

Encryption at rest

Every private key and every secret setting in the database is encrypted with your key, DATA_KEY. If you do not set one, the portal creates it on first start and shows it once after setup; Health reminds you to move it off the data volume by setting DATA_KEY.

• An older unencrypted database is encrypted automatically the first time it starts with a key.
• The portal refuses to start without the key, or with a different one, so data can never be silently mixed.
• Health → Encryption at rest confirms it is on.

Keep a copy of DATA_KEY off the server. It is the only way to read the database and its backups.

Passwords and sessions

• The administrator password is stored as a salted, deliberately slow hash.
• Repeated failed sign-ins lock the account for a while.
• Sessions expire after the time you set in Config → Settings → General.

Who can do what

• Roles: read-only, admin and super admin, each with adjustable permissions.
• Departments: each team sees only its own certificates.
• Download policy: decide which formats (for example private keys) may be downloaded in the browser and through the API.
• Audit log: every action is recorded, can be exported as CSV or JSON, and can be forwarded to your SIEM over syslog, GELF, JSON or HTTPS.

Backup

Config → Settings → Backup & storage → Download backup gives you a consistent copy of the database. Secrets inside it stay encrypted.

To restore:

1. Stop the container.
2. Put the backup file back in place of the database.
3. Start it again with the same DATA_KEY.

Health reminds you when no backup has been taken, or when the last one is more than 30 days old.

Upgrades

Download docker-compose.yml again from the Downloads page, then:

docker compose pull && docker compose up -d

Your data is kept across upgrades. Take a backup first if you like to be careful.

Never run docker compose down -v. The -v deletes your data and every certificate.