Changeset 0.9.4 (#54)

server/config/config.go

@@ -21,6 +21,11 @@ type Config struct {
 
 	// Seed users (dev/test only) — CSV: "user:pass:role,user2:pass2:role2"
 	SeedUsers string
+
+	// API key encryption (required for v0.9.4+)
+	// Used to derive AES-256 key for global/team provider API keys.
+	// Personal keys use per-user UEK (derived from password).
+	EncryptionKey string
 }
 
 // Load reads configuration from environment variables.
@@ -39,6 +44,7 @@ func Load() *Config {
 		AdminPassword: getEnv("SWITCHBOARD_ADMIN_PASSWORD", ""),
 		AdminEmail:    getEnv("SWITCHBOARD_ADMIN_EMAIL", ""),
 		SeedUsers:     getEnv("SEED_USERS", ""),
+		EncryptionKey: getEnv("ENCRYPTION_KEY", ""),
 	}
 }