feat: backup encryption#1400

Closed

caffeinated92 wants to merge 13 commits into

Commits on Mar 13, 2026

Align backup decryption with salted passphrase format
caffeinated92
committed
Secure backup encryption by passing passphrase via file descriptor
caffeinated92
committed
Add safe per-file encrypted restore with transactional rollback and unsafe override
caffeinated92
committed
cluster: validate symlink targets in archive extraction to prevent path traversal
caffeinated92
committed
cluster: harden archive extraction for symlinks and hardlinks
caffeinated92
committed
clients: stream encrypted backup files through OpenSSL
caffeinated92
committed
cluster: add passphrase fallback warnings and strict mode for backup encryption
caffeinated92
committed
cluster: add tests for backup encryption failures and archive extraction hardening
caffeinated92
committed