Skip to content

Encryption at Rest

Jump to bottom
Ryan edited this page Jan 16, 2026 · 1 revision

Encryption at Rest

FileRise supports folder-level encryption at rest using libsodium secretstream. It encrypts files on disk while allowing normal access through the app.

Requirements

  • PHP with libsodium (sodium extension) enabled.
  • A master key configured via environment variable or key file.

Master key configuration

Option A (recommended for containers):

FR_ENCRYPTION_MASTER_KEY=base64:...   # 32-byte key

Accepted formats:

  • 64 hex characters (32 bytes)
  • base64:... (32 bytes after decode)

Option B (admin-generated key file):

  • File: /var/www/metadata/encryption_master.key
  • If FR_ENCRYPTION_MASTER_KEY is set, the key file is ignored.

Behavior and limitations

Encrypted folders disable:

  • WebDAV
  • Sharing
  • ZIP create/extract
  • ONLYOFFICE editing

Encrypted files are decrypted on download. Range requests are intentionally disabled for encrypted files.

Backup and recovery

  • Back up /var/www/uploads and /var/www/metadata together.
  • Keep the master key safe. Losing it makes encrypted data unrecoverable.

Clone this wiki locally