✨ Allow for an asymmetric public key encryption

[mykolasolodukha]

What?

• Allow using ENCRYPT_WITH_PUBLIC_KEY_ID env parameter to encrypt the backups with the User's GPG public key.
• Update documentation accordingly.
• [Extra] Allow using the S3-server default storage class (4b45089).
• Fix the shfmt formatting.

Why?

• By using asymmetric encryption, the data protection would still be insured even when a bad actor gains read access to the s3backup service configs and the access to the S3 storage. When the said actor gains write access, it's still a game over for whoever's trying to protect that data.

How to test?

• It's backward-compatible, so everything that works now should also work in this version.
• 1. Generate a new PGP key if you don't have one (instructions).
  2. Get your key ID (don't worry, it's public information).

     gpg --list-secret-keys --keyid-format long
     # [keyboxd]
     # ---------
     # sec   ed25519/7929C6D3BB256BCC 2024-03-22 [SC]
     #       5815326E1FAB78E966837F287929C6D3BB256BCC  <-- THIS IS YOUR KEY ID
     # uid                 [ultimate] Test Dokku Backup (one-time-key) <s3_backup_test@dokku.com>
     # ssb   cv25519/4A947B3B74A421B7 2024-03-22 [E]
     
     # export MY_PUBLIC_KEY_ID='5815326E1FAB78E966837F287929C6D3BB256BCC'

  3. Upload your keys to a keyserver:

     gpg --send-keys --keyserver keyserver.ubuntu.com $MY_PUBLIC_KEY_ID

  4. (assuming you have the environment variables loaded to your shell) Run:

     docker run -it \
         -e AWS_ACCESS_KEY_ID=ID \
         -e AWS_SECRET_ACCESS_KEY=KEY \
         -e BUCKET_NAME=backups \
         -e BACKUP_NAME=backup \
         -e ENCRYPT_WITH_PUBLIC_KEY_ID=$MY_PUBLIC_KEY_ID \
         -v /path/to/backup:/backup dokku/s3backup

Anything else?

• Practise shows that Ubuntu's keyserver is sometimes buggy when it comes to uploading your public keys. So it might take some time (or you might use any other keyserver by passing the -e KEYSERVER=$YOUR_KEYSERVER to the docker run command.

[josegonzalez]

Mind resolving the shfmt issues?

[mykolasolodukha]

@josegonzalez feel free to push directly into the branch👌

It might take me a while to figure out what's wrong with the shfmt lint, so might be faster if you do it😅

[mykolasolodukha]

@josegonzalez I think I've got this.

[mykolasolodukha]

@josegonzalez any chance we can merge this?

[josegonzalez]

This was merged and released.