stwaidele/dorfteich
1
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases 22 Wiki Activity

[VS-NfD] Restrict backup targets to an allowlist and allow remote targets to be disabled at deploy time #192

New Issue
Closed
opened 2026-07-30 01:43:30 +02:00 by fable-5 · 1 comment
fable-5 commented 2026-07-30 01:43:30 +02:00
Collaborator
Copy Link

Plan reference: 20-massnahmenplan.md -> Phase 2
ADR: ADR 0026
Effort: M (2 AT)
Depends on: —

Context

A backup destination is an egress path for the full content of the
instance. In a VS zone the set of permissible destinations is decided by
the operator, not by whoever holds Site-Admin. Encryption stays out —
media protection is the platform's base function (ADR 0019).

Current state

  • Remote target is a freely configurable WebDAV/Nextcloud URL:
    backup.nextcloud.baseUrl in
    apps/api/src/settings/instance-settings.service.ts (validated as a URL,
    no host restriction), consumed via
    apps/api/src/backup/backup-target.service.ts:3,65 and
    apps/api/src/admin/backup-admin.service.ts:27,112,146.
  • A second remote path is the rsync mirror (apps/backup/src/mirror.ts,
    ADR 0015, issue #84).
  • No allowlist and no deploy-level kill switch for either path.

Acceptance criteria

  • A deploy-level allowlist (env, not a runtime setting) constrains
    permissible backup destination hosts; a value outside it is rejected
    with a clear admin-visible error.
  • An empty allowlist disables all remote targets — WebDAV and rsync
    mirror — and the admin UI reflects that they are unavailable, not
    merely unconfigured.
  • Tests: destination outside the allowlist rejected; empty allowlist
    leaves only the local target; existing configured destination inside
    the allowlist unaffected.
  • docs/architecture/operations.md and the hardening guide (#227)
    document the "local only" reference configuration.

Out of scope

Application-side backup encryption (deliberately excluded, ADR 0019/0026)
and changes to the restore flow.

**Plan reference:** `20-massnahmenplan.md` -> Phase 2 **ADR:** ADR 0026 **Effort:** M (2 AT) **Depends on:** — ## Context A backup destination is an egress path for the full content of the instance. In a VS zone the set of permissible destinations is decided by the operator, not by whoever holds Site-Admin. Encryption stays out — media protection is the platform's base function (ADR 0019). ## Current state - Remote target is a freely configurable WebDAV/Nextcloud URL: `backup.nextcloud.baseUrl` in `apps/api/src/settings/instance-settings.service.ts` (validated as a URL, no host restriction), consumed via `apps/api/src/backup/backup-target.service.ts:3,65` and `apps/api/src/admin/backup-admin.service.ts:27,112,146`. - A second remote path is the rsync mirror (`apps/backup/src/mirror.ts`, ADR 0015, issue #84). - No allowlist and no deploy-level kill switch for either path. ## Acceptance criteria - [ ] A deploy-level allowlist (env, not a runtime setting) constrains permissible backup destination hosts; a value outside it is rejected with a clear admin-visible error. - [ ] An empty allowlist disables **all** remote targets — WebDAV and rsync mirror — and the admin UI reflects that they are unavailable, not merely unconfigured. - [ ] Tests: destination outside the allowlist rejected; empty allowlist leaves only the local target; existing configured destination inside the allowlist unaffected. - [ ] `docs/architecture/operations.md` and the hardening guide (#227) document the "local only" reference configuration. ## Out of scope Application-side backup encryption (deliberately excluded, ADR 0019/0026) and changes to the restore flow.
fable-5 added this to the M24 — VS-NfD: security quick wins milestone 2026-07-30 01:43:30 +02:00
fable-5 added the
area:storage
effort:M
vs-nfd
 labels 2026-07-30 01:43:30 +02:00
fable-5 commented 2026-07-30 12:34:14 +02:00
Author
Collaborator
Copy Link

Delivered by PR #247 (394d1c8), merged to main fast-forward (self-merge per Stefans go this session). CI run 487 green. NOTE for the next prod release: set BACKUP_ALLOWED_TARGETS in the prod .env on ONE and sync the stage composes, or the BASEL mirror stops (see Handoff release marker). Closing.

Delivered by PR #247 (394d1c8), merged to main fast-forward (self-merge per Stefans go this session). CI run 487 green. NOTE for the next prod release: set BACKUP_ALLOWED_TARGETS in the prod .env on ONE and sync the stage composes, or the BASEL mirror stops (see Handoff release marker). Closing.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels   
area:auth

   
area:docs

   
area:export

   
area:ops

   
area:storage

   
area:supply-chain

   
auth

Authentication, permissions, quotas

  
backend

API server (apps/api)

  
blocked

Blocked on external dependency/infrastructure

  
collab

Collaboration server (apps/collab)

  
deployment

Docker, CI/CD, hosting

  
docs

Documentation

  
effort:L

   
effort:M

   
effort:S

   
frontend

SPA (apps/web)

  
plugins

Plugin system and SDK

  
qa

Tests, fixtures, e2e

  
vs-nfd

   
vs-nfd:blocker
No Label
area:auth
area:docs
area:export
area:ops
area:storage
area:supply-chain
auth
backend
blocked
collab
deployment
docs
effort:L
effort:M
effort:S
frontend
plugins
qa
vs-nfd
vs-nfd:blocker
Milestone
Clear milestone
No items
No Milestone
M24 — VS-NfD: security quick wins
Projects
Clear projects
No project
Assignees
Clear assignees
No Assignees
1 Participants
Notifications
Due Date
The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: stwaidele/dorfteich#192
No description provided.
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?