Encrypted-at-rest R2 storage for scrubbed reports #9

Closed
opened 2026-07-02 17:44:27 +00:00 by JMR-dev · 0 comments
JMR-dev commented 2026-07-02 17:44:27 +00:00 (Migrated from github.com)

Context

Implements the storage requirement of JMR-dev/LibreMail#34: "stored in a Cloudflare R2 bucket for review in an encrypted state."

Scope

  • Store each scrubbed report (from #8) in the R2 bucket (from #2), encrypted per the scheme decided in #5.
  • Verify stored objects are not readable without the documented key.

Acceptance criteria

  • A POST accepted by #7, scrubbed by #8, ends up encrypted in R2; the object cannot be read without the key from #5's decision.

Dependencies

Depends on #2 (R2 bucket), #5 (encryption scheme decision), #7 (ingest endpoint), #8 (scrubbing).

## Context Implements the storage requirement of [JMR-dev/LibreMail#34](https://github.com/JMR-dev/LibreMail/issues/34): "stored in a Cloudflare R2 bucket for review in an encrypted state." ## Scope - [ ] Store each scrubbed report (from #8) in the R2 bucket (from #2), encrypted per the scheme decided in #5. - [ ] Verify stored objects are not readable without the documented key. ## Acceptance criteria - A POST accepted by #7, scrubbed by #8, ends up encrypted in R2; the object cannot be read without the key from #5's decision. ## Dependencies Depends on #2 (R2 bucket), #5 (encryption scheme decision), #7 (ingest endpoint), #8 (scrubbing).
Sign in to join this conversation.