real: sec Use SSE-C for the mail bucket. #511

Problem

The mail bucket has no encryption at rest. Hetzner Object Storage only encrypts objects with SSE-C when the client supplies a key.

Details

Hetzner Object Storage has no default encryption. The app uploads raw message bodies through django-storages, and the storage s3proxy serves them. Neither sends SSE-C headers.

SSE-C needs the key on every PUT and GET. The storage proxy must pass the headers through, or hold the key itself. Signed URLs must still work.

File references:

• root/settings.py configures django-storages.
• deploy/k8s/mail.yaml runs the storage proxy.
• services/email/message/models.py defines raw_body.

Suggested fix

Add SSE-C support to the write and read path. Test the proxy and signed URLs. Keep the key in a Secret. Accept that a full cluster compromise exposes the key. If that tradeoff is not acceptable, prefer app-level encryption.