# ADR 0005: E2EE deferred, libsignal when implemented

- Status: accepted
- Date: 2026-09

## Context
A family messenger should eventually protect message content at rest and in
transit, ideally with end-to-end encryption. Rolling a custom crypto protocol
is unsafe and a red flag in review.

## Decision
- In transit: TLS everywhere (Caddy on the VPS / reverse proxy; homelab
  ingress).
- At rest: Postgres and media disk live on trusted hardware.
- E2EE: deferred to a future major version, implemented with an established
  library (libsignal) — never hand-written primitives.

## Consequences
- The wire protocol and data model are ready for E2EE (opaque message bodies,
  device-agnostic session model).
- No false-security claims in the README.