Encrypting Odoo Data at Rest: Database Encryption Setup

# During Ubuntu installation:
# Choose "Encrypt the system"
# Enter passphrase
# Installation proceeds with full encryption

# Create encrypted partition for database
sudo cryptsetup luksFormat /dev/sdb1
# Enter passphrase (use STRONG passphrase!)
# WARNING: This formats the partition

# Open encrypted partition
sudo cryptsetup luksOpen /dev/sdb1 odoo_data

# Create filesystem
sudo mkfs.ext4 /dev/mapper/odoo_data

# Mount it
sudo mount /dev/mapper/odoo_data /var/lib/postgresql

# Use it for PostgreSQL data directory
# All database files now encrypted!

# Install PostgreSQL with TDE
docker run -e POSTGRES_PASSWORD=secret \
           -e ENABLE_PG_TDE=1 \
           postgres:15-bookworm

# Connect to PostgreSQL
psql -h localhost -U postgres

# Enable PG_TDE extension
CREATE EXTENSION pg_tde;

# Create encrypted table
CREATE TABLE customers (
    id SERIAL PRIMARY KEY,
    name TEXT,
    email TEXT,
    credit_card TEXT
) WITH (encryption='on');

# Use normally - encryption transparent
INSERT INTO customers VALUES (1, 'John', 'john@example.com', '4111-1111-1111-1111');

# On disk: All encrypted
# In Odoo: Works normally

# In Odoo, encrypt sensitive fields manually
from cryptography.fernet import Fernet

class ResPartner(models.Model):
    _inherit = 'res.partner'
    
    # Store encrypted credit card
    credit_card_encrypted = fields.Char(
        string='Credit Card (Encrypted)',
        store=True
    )
    
    # Encryption key (store in environment variable!)
    ENCRYPTION_KEY = os.environ.get('ENCRYPTION_KEY')
    
    def encrypt_credit_card(self, card_number):
        """Encrypt credit card number."""
        cipher = Fernet(self.ENCRYPTION_KEY.encode())
        encrypted = cipher.encrypt(card_number.encode())
        return encrypted.decode()
    
    def decrypt_credit_card(self):
        """Decrypt credit card number."""
        cipher = Fernet(self.ENCRYPTION_KEY.encode())
        decrypted = cipher.decrypt(self.credit_card_encrypted.encode())
        return decrypted.decode()

# Use full disk encryption during OS installation
# Or create encrypted partition for PostgreSQL:
sudo cryptsetup luksFormat /dev/sdb1
# Passphrase: SuperSecure123!_DB_Encrypt

sudo cryptsetup luksOpen /dev/sdb1 odoo_encrypted
sudo mkfs.ext4 /dev/mapper/odoo_encrypted

# Add to /etc/fstab to auto-mount
echo "/dev/mapper/odoo_encrypted /var/lib/postgresql ext4 defaults 0 2" | sudo tee -a /etc/fstab

# Move PostgreSQL to encrypted partition
sudo systemctl stop postgresql
sudo mv /var/lib/postgresql /var/lib/postgresql.backup
sudo mount /dev/mapper/odoo_encrypted /var/lib/postgresql
sudo mv /var/lib/postgresql.backup/* /var/lib/postgresql/
sudo chown -R postgres:postgres /var/lib/postgresql
sudo systemctl start postgresql

-- Enable TDE extension
CREATE EXTENSION pg_tde;

-- Create encrypted tables
CREATE TABLE res_partner (
    id SERIAL PRIMARY KEY,
    name TEXT,
    email TEXT,
    phone TEXT,
    credit_card_encrypted TEXT
) WITH (encryption='on');

-- All fields in this table encrypted at database level
-- PLUS encrypted at disk level (LUKS)
-- Double encryption!

# Encryption key for LUKS partition
# Store in secure location (password manager, HSM, Key Vault):
SuperSecure123!_DB_Encrypt

# Encryption key for PG_TDE
# Store separately from database:
export PG_TDE_KEY="your_secure_encryption_key_here"

# Encryption key for application-level encryption
# Store in environment variable:
export ENCRYPTION_KEY="your_fernet_key_here"

# Test boot process:
# Server boots
# LUKS partition requires passphrase
# Enter passphrase → partition unlocks
# PostgreSQL starts → accesses encrypted data
# Odoo starts → works normally

# Verify disk encryption is working
sudo cryptsetup status odoo_encrypted
# Output:
# /dev/mapper/odoo_encrypted is active.
# type:    LUKS2
# cipher:  aes-xts-plain64
# keysize: 256 bits

# Try to read raw disk data (attacker's attempt)
sudo dd if=/dev/sdb1 bs=512 count=10
# Output: Binary gibberish (encrypted)

# Only accessible through encrypted mapping
sudo dd if=/dev/mapper/odoo_encrypted bs=512 count=10
# Output: Readable PostgreSQL data

# Verify PG_TDE encryption
SELECT pg_tde_is_encrypted('res_partner');
# Output: t (true - encrypted)

# Back up LUKS header (CRITICAL!)
sudo cryptsetup luksHeaderBackup /dev/sdb1 --header-backup-file luks-header.img

# Store backup in multiple secure locations:
# 1. Encrypted USB drive in safe
# 2. Encrypted cloud storage (Google Drive, Dropbox)
# 3. Printed on paper in safe (!)

# Test recovery procedure annually:
sudo cryptsetup luksHeaderRestore /dev/sdc1 --header-backup-file luks-header.img