Skip to content
MyDrive Docs

Security & backups

Encryption at rest

When MYDRIVE_ENCRYPTION_KEY is set, MyDrive encrypts files on disk before they’re written to the mydrive_data volume. The database stores metadata (filenames, folder structure, sharing permissions) separately from file contents.

Generate a strong key before your first deployment:

Terminal window
openssl rand -hex 32

Store this value somewhere safe outside the container — losing it makes existing files unrecoverable.

Rotating the encryption key

  1. Set MYDRIVE_ENCRYPTION_KEY_NEW to a freshly generated key alongside the existing MYDRIVE_ENCRYPTION_KEY.
  2. Restart the stack. MyDrive re-encrypts files in the background using the new key.
  3. Once the admin panel shows rotation as complete, remove the old key and rename MYDRIVE_ENCRYPTION_KEY_NEW to MYDRIVE_ENCRYPTION_KEY.

Backups

Set MYDRIVE_BACKUP_TARGET to s3 or local, and MYDRIVE_BACKUP_SCHEDULE to a cron expression, to enable automatic backups of both the database and the encrypted file volume.

Terminal window
MYDRIVE_BACKUP_TARGET=s3
MYDRIVE_BACKUP_S3_BUCKET=mydrive-backups
MYDRIVE_BACKUP_SCHEDULE=0 3 * * *

Backups include the database dump and file volume, both still encrypted with your active key.

Manual backup

Terminal window
docker compose exec mydrive mydrive-cli backup --output /data/backup.tar.gz

Restoring

Terminal window
docker compose exec mydrive mydrive-cli restore --input /data/backup.tar.gz

Always restore into a fresh instance with the same MYDRIVE_ENCRYPTION_KEY used to create the backup — restoring with a different key will leave files unreadable.

Network and access hardening

  • Always run MyDrive behind a reverse proxy with TLS in production (see installation).
  • Set a long, random MYDRIVE_SECRET_KEY; never reuse it across environments.
  • Restrict direct access to the database container — only the mydrive service should reach port 5432.
  • Consider enabling two-factor authentication for administrator accounts from Admin → Security.