Skip to content

CipherMoth v2.0.0

Choose a tag to compare

View all tags
@mr-grj mr-grj released this 15 Oct 06:58
· 47 commits to master since this release
v2.0.0
fe924aa

CipherMoth 2.0 now uses SQLite, with no PostgreSQL server required.

A fresh installation is two containers (backend and frontend) and one Docker volume holding the vault as a single SQLite file. There's no database service, no database credentials, and the .env file is optional.

curl -fsSL https://raw.githubusercontent.com/mr-grj/ciphermoth/master/install.sh | sh

Coming from 1.x (PostgreSQL)

2.0 needs a fresh installation: it starts a new, empty vault.

  • Your PostgreSQL vault is not converted. It's also never deleted: the PostgreSQL volume stays exactly as it is, and pinning CIPHERMOTH_VERSION=1.6.0 brings the old version back.
  • To bring your active entries along, export an encrypted backup ZIP in 1.6.0 and import it into the new vault. The ZIP leaves out the trash, password history, attachments and settings.
  • Safety nets:
    • A 2.0 backend started from a 1.x compose file exits with a message and creates no vault.
    • The 1.x one-click updater refuses 2.0 before it changes anything.
    • install.sh stops when it finds an old PostgreSQL install, unless you confirm, and keeps backups of your compose file and .env.

The full steps, and how to go back, are in docs/UPDATING.md.

Updating from 2.0 on

One-click updates are temporarily unavailable, because the old updater was built around PostgreSQL. Update by hand, taking a complete snapshot of the vault first:

docker compose -f docker-compose.prod.yml exec backend ciphermoth-admin snapshot
docker compose -f docker-compose.prod.yml pull
docker compose -f docker-compose.prod.yml up -d

Snapshots and restores

ciphermoth-admin snapshot makes a consistent, integrity-checked copy of the complete vault (trash, history, attachments and settings) while CipherMoth runs. ciphermoth-admin check checks a vault or a snapshot.

ciphermoth-admin restore puts a snapshot back while CipherMoth is stopped:

  • It refuses while anything else has the vault open.
  • It keeps the vault it replaces byte for byte.
  • It survives being interrupted.

The encrypted backup ZIP remains an export of your active entries, not a copy of the vault.

Security notes

  • Encryption is unchanged. It is field-level, not whole-file: passwords, notes, URLs, 2FA secrets, tags, folders, custom fields, history and attachments are encrypted with a key derived from your master password (Argon2id, Fernet).
  • Still in plaintext: entry names, usernames and descriptions, until the planned vault format v2. Anyone with the vault file or a snapshot can read them.
  • SQLite runtime: the images run SQLite 3.53 (3.51.3 or newer is required, for the WAL-reset fix), with full sync, secure_delete, a 0600 vault file in a 0700 folder, and a non-root backend.
  • Signed images: the backend and frontend images are signed with cosign; docs/UPDATING.md shows how to verify them.

The complete list of changes is in the CHANGELOG.

Assets 2
Loading