Skip to content
LibreDrive Docs

Security & backups

Encryption at rest

LibreDrive uses envelope encryption. Every file gets a random per-file Data Encryption Key (DEK); the file content is AES-256-GCM-encrypted under that DEK. The DEK itself is wrapped with the instance’s Key Encryption Key (KEK), which comes from LIBREDRIVE_ENCRYPTION_KEY. Only the small wrapped DEK is stored in Postgres — the KEK never touches disk, and LIBREDRIVE_ENCRYPTION_KEY is required to start the instance at all.

Generate a strong key before your first deployment:

Terminal window
openssl rand -base64 32

Store this value somewhere safe outside the container — losing it makes existing files unrecoverable.

Rotating the encryption key

Rotation re-wraps every file’s DEK; it never re-encrypts file content, so it’s safe to run against a live instance with zero downtime.

  1. Generate a new key (openssl rand -base64 32) and set it as LIBREDRIVE_ENCRYPTION_KEY_NEW, alongside the existing LIBREDRIVE_ENCRYPTION_KEY, then restart the stack.

  2. Run the rotation:

    Terminal window
    docker compose exec libredrive libredrive-cli rotate-key

  3. Once it reports Rewrapped N file key(s) with nothing left to do, promote the new key: set LIBREDRIVE_ENCRYPTION_KEY to the value of LIBREDRIVE_ENCRYPTION_KEY_NEW, remove LIBREDRIVE_ENCRYPTION_KEY_NEW, and restart.

Backups

Set LIBREDRIVE_BACKUP_TARGET to s3 or local, and LIBREDRIVE_BACKUP_SCHEDULE to a cron expression, to enable automatic backups on a schedule:

Terminal window
LIBREDRIVE_BACKUP_TARGET=s3
LIBREDRIVE_BACKUP_S3_BUCKET=libredrive-backups
LIBREDRIVE_BACKUP_SCHEDULE=0 3 * * *

A backup is a pg_dump of the database plus the local file store (when using the local storage driver), packed into one tar.gz. Scheduled and on-demand backups call the same backup service, so they can’t drift apart.

Manual backup

Terminal window
docker compose exec libredrive libredrive-cli backup --output /data/backups/manual-$(date +%F).tar.gz

Restoring

Terminal window
docker compose exec libredrive libredrive-cli restore --input /data/backups/manual-2026-09-10.tar.gz

Always restore into a fresh instance with the same LIBREDRIVE_ENCRYPTION_KEY used to create the backup — restoring with a different key will leave files unreadable.

Network and access hardening

  • Always run LibreDrive behind a reverse proxy with TLS in production (see installation) — the container only binds to 127.0.0.1:8080 and does not terminate TLS itself.
  • Set a long, random LIBREDRIVE_SECRET_KEY; never reuse it across environments.
  • Restrict direct access to the db container — only the libredrive service should reach port 5432; the bundled docker-compose.yml doesn’t publish it externally by default.
  • Keep LIBREDRIVE_ENCRYPTION_KEY and your .env file out of version control and off any backup that isn’t itself encrypted.