sasa/wireguard-admin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add specification

Browse Source
This commit is contained in:
sasa
2026-10-18 00:19:52 +03:00
parent a28334013b
commit 86dbead893
7 changed files with 212 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/adr/0002-client-secret-storage.md
+3
View File
@@ -0,0 +1,3 @@
# New secrets are encrypted without a password; reissuing requires decryption
The application must create new clients without requesting a password and require a password to reissue their private keys. Asymmetric encryption was chosen: the vault's public key is available for writing, while its secret key is password-protected. The vault is backed up and restored as a whole without decryption. Password loss is unrecoverable; this scheme does not encrypt the server configuration, original files, or the entire backup archive.