21 lines
753 B
Markdown
21 lines
753 B
Markdown
|
# ADR 0005: E2EE deferred, libsignal when implemented
|
||
|
|
|
||
|
|
- Status: accepted
|
||
|
|
- Date: 2026-09
|
||
|
|
|
||
|
|
## Context
|
||
|
|
A family messenger should eventually protect message content at rest and in
|
||
|
|
transit, ideally with end-to-end encryption. Rolling a custom crypto protocol
|
||
|
|
is unsafe and a red flag in review.
|
||
|
|
|
||
|
|
## Decision
|
||
|
|
- In transit: TLS everywhere (Caddy on the VPS / reverse proxy; homelab
|
||
|
|
ingress).
|
||
|
|
- At rest: Postgres and media disk live on trusted hardware.
|
||
|
|
- E2EE: deferred to a future major version, implemented with an established
|
||
|
|
library (libsignal) — never hand-written primitives.
|
||
|
|
|
||
|
|
## Consequences
|
||
|
|
- The wire protocol and data model are ready for E2EE (opaque message bodies,
|
||
|
|
device-agnostic session model).
|
||
|
|
- No false-security claims in the README.
|