Messenger/docs/adr/0005-e2ee-roadmap.md

ADR 0005: E2EE deferred, libsignal when implemented

• Status: accepted
• Date: 2026-09

Context

A family messenger should eventually protect message content at rest and in transit, ideally with end-to-end encryption. Rolling a custom crypto protocol is unsafe and a red flag in review.

Decision

• In transit: TLS everywhere (Caddy on the VPS / reverse proxy; homelab ingress).
• At rest: Postgres and media disk live on trusted hardware.
• E2EE: deferred to a future major version, implemented with an established library (libsignal) — never hand-written primitives.

Consequences

• The wire protocol and data model are ready for E2EE (opaque message bodies, device-agnostic session model).
• No false-security claims in the README.