Encrypt sensitive data

“Encrypt the data” means nothing on its own. You must say what, against whom and when: network traffic, files at rest, backups, or only a few columns. Each layer has a cost and its own key. Mixing them up often produces a server described as encrypted whose exports remain readable.

Transport: TLS wherever data moves

The minimum is HTTPS on websites and APIs. Certbot with the Nginx plugin installs the certificate and schedules renewal:

sudo apt install certbot python3-certbot-nginx
sudo certbot --nginx -d votre-domaine.fr
sudo certbot renew --dry-run

A systemd timer handles renewal: check it with systemctl list-timers | grep certbot, especially after a migration. For a remote database or a mail server, use TLS as well, with a certificate for the hostname rather than the IP address.

Application-level encryption

Some data should never be stored in plaintext: API tokens, private keys, banking or health data. Encrypt it before insertion, with AES-256-GCM or libsodium, a unique nonce per record and a key identifier stored next to the ciphertext. That identifier lets you rotate keys without rewriting the whole database.

Never encrypt passwords: hash them with Argon2id or bcrypt, and never decrypt them. Encryption is reversible, hashing is not. Column encryption prevents searching and sorting on those columns: if you need it, plan a blind index or accept the limitation.

Encrypted backups

On Debian 13, install the tool with sudo apt install age if it is not already present.

tar -czf app.tar.gz /var/www/app
age -r AGE_PUBLIC_KEY -o app.tar.gz.age app.tar.gz
age -d -i cle.age.txt app.tar.gz.age | tar -tzf -

Encrypt before copying off the server. The private key must never sit inside the backup or in a Git repository. Test decryption on another machine: an unreadable backup is not a backup. The 3-2-1 rule still applies, with three copies, two media and one off site.

Manage keys

One key per purpose, a creation date, an owner. Keep the private key in a secrets manager or a mode 600 file outside the web root. During rotation, decrypt with the old key, re-encrypt with the new one, then revoke the old key.

On a NeoHeberg VPS, the root disk is a system container: LUKS root encryption is not available. Application-level encryption and encrypted backups therefore become the real protection for sensitive data.

Verify

stat -c '%a %n' cle.age.txt
age -d -i cle.age.txt app.tar.gz.age | tar -tzf - | head
curl -sI https://votre-domaine.fr

Expected: 600 on the key, a readable file list, a valid HTTPS header. Also confirm that no log or error message prints a plaintext value. A key present on a compromised server is considered lost: rotation and revocation belong in the plan, not in improvisation.