Transparent server-side encryption with stable master key

Spegnimento

23 marzo 2026 alle ore 22:35 UTC

Autore

Kamo

Impegno

be03417

- Add permanent notes.master-encryption-key to ConfigMap (was generating a random key on each pod restart, making old notes undecryptable) - Always encrypt content on create/update, always decrypt on read - Extract decryptDTO helper for consistent decryption across getNote, getAllNotes, and searchNotes - Notes encrypted with a lost key show null content (unrecoverable) but their data is preserved in DB for potential future recovery