With the new addition of privacy-focused apps like Vaultwarden and Nextcloud, without full disc encryption anyone able to physically access the SSD attached to the Umbrel setup would have access to those app’s sensitive files.
This seems incredibly important.
That is also my concern… I am not starting w/o full encryption. Not Bitwarden nor Nextcloud
Maybe @ mayank can give here some infprmation
Looking closer at the documentation for both apps, it appears to be done via the app themselves.
Nextcloud includes a server side Encryption app, and when it is enabled by your Nextcloud administrator all of your Nextcloud data files are automatically encrypted on the server.
Vaultwarden does so by default. Only the client device, meaning the browser extension or Bitwarden client program, has access to your decrypted data. All data on the server is encrypted using an encryption key generated from that master password.
See:
https://www.reddit.com/r/selfhosted/comments/oqknh7/vaultwarden_data_path_encrypted/
it would be nice to have fully encrypted drive. With long key. It adds plausible deniability on running node, having any bitcoin at all, having list of transactions, etc. US government can’t legally compel you to give up password. breaking encryption for the whole filesystem is unfeasible (unless you get full power of NSA, and even them, you are probably too small fish to fry, and disclosing such capability for nosy IRS who want to get their 50k or 150k is not worth it)
So it is totally encrypted on Umbrel Node HardDrive ?
Please guys tell me is there Browser extension for Brave or does it only work with Tor ? IOS app ?
I thought that Vaultwarden is not Bitwarden…
Unless it’s on the version that came out today (which i doubt) the disk is not encrypted att rest.
I would like to have a complete make over of the disk management, with btrfs filesystem, where each app folder gets it’s own subvolume, and the filesystem is located on a LUKS encrypted volume.
One problem with this is that the encryption key need to be accessible or typed in at boot somehow.
Perhaps this could be a tiny TOR service outside docker that decrypt and mount the fs, then starts the container service, so it can be managed remotely.
Thinking of it, the umbrel web GUI could probably do this. Just use the user password to encrypt when installing. It cannot run in docker thought.
From this link you shared:
And note that Server Side Encryption only encrypts the content of files, not their name or folder structure. Using object storage like S3 works around this limitation as that type of storage back-end never leaks file or folder names.
Also note that when external storage is not used and a server-wide key is used, storing the encryption keys together with the data means little protection is afforded in cases the drives are stolen. For this threat model, a full-disk-encryption technology is often a better choice than the built-in Server Side Encryption in Nextcloud. dm-crypt, eCryptFS and EncFS tend to be good choices on the server, also allowing modern encryption acceleration features in CPU’s and operating systems to be used.
(emphasis mine)
In short: depending on your threat model, if you are worried that someone could unplug your HDD/SSD from Umbrel and steal it, you should fully encrypt the HDD/SDD, not rely on NextCloud’s built-in encryption.
I installed Umbrel on an operating system of my preference (not UmbrelOS, which is basically RaspberryPi OS + Umbrel installed out-of-the-box) so I was able to encrypt the HDD with VeraCrypt. As you, I’m also thinking about NextCloud.
But I’m facing problems with my setup, as I reported here: