The discussion revolves around adding built-in support for automatic backup encryption (e.g., via GPG) in Discourse, particularly to meet compliance requirements for uploading encrypted backups to third-party services like S3. jscinoz, an IT officer for Pirate Party Australia, highlights that while Discourse’s automated backups work well, the lack of built-in encryption prevents S3 uploads per policy. They suggest that integrating automatic GPG encryption before S3 upload would be ideal. sam acknowledges the request but notes it’s unlikely to be prioritized soon. riking advises manually renaming monthly backups to avoid auto-deletion and mirroring them elsewhere, noting that backups contain all private data and should be encrypted offline. saper proposes splitting public/private data and encrypting only sensitive parts, referencing Wikimedia’s public data model and pansraT’s encrypted S3 backup approach. nahtnam suggests allowing custom pre/post-backup scripts as a flexible workaround. Victoria_Russell follows up years later asking if automatic encryption was implemented; codinghorror replies that encryption is typically handled at the OS level (e.g., disk encryption) or via custom scripts before shipping to S3, which is simpler than building it into Discourse. Victoria_Russell thanks the team for the response.
I’m one of the IT officers of Pirate Party Australia, and last year set up a self-hosted Discourse instance for the party which has been going quite well. While we use the automated backup functionality, sadly we can’t use the built-in S3 upload functionality, as internal policy mandates that any data stored with third-party services must be encrypted locally.
While it’s not too difficult to simply write some external script invoked via cron to encrypt the backup archives then upload to S3 outside of Discourse, it’s admittedly a bit of a hack. Since Discourse itself supports automatic backups (& upload to S3), it’d be great if there was support for automatically encrypting (ideally via GPG, since that’s already widely used and due to its asymmetric nature, no passphrases would be required during back up operations) backup archives before uploading to S3.
Is there any possibility of such functionality being implemented?
Word of advice: you (in particular) will likely want to rename, let’s say one backup a month, to a name that Discourse won’t auto-delete when it reaches the maximum daily backups limit, and mirror that selected one elsewhere.
Just breaking the date format should suffice to avoid the auto-deletion (e.g. 2015-02-11 into 2015_Feb or something like that).
You’ll also be able to be a bit more lax in where you put the backups, because they’re encrypted and the private key is offline.
(Further explaining that: Backups contain all the private messages and drafts stored on the server! Which is why there’s a standard admonishment to not let non-admins get backups.)
This is generally handled by the operating system, so files are automatically encrypted as they are written to the disk. It’s much easier to think about this way.
Internally for our hosting we do also encrypt each backup as an extra step in the process before shipping it to Amazon S3.
