stwaidele/dorfteich
1
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases 22 Wiki Activity

[VS-NfD] Run and document a deployment in a network-isolated environment #220

New Issue
Closed
opened 2026-07-30 01:43:50 +02:00 by fable-5 · 1 comment
fable-5 commented 2026-07-30 01:43:50 +02:00
Collaborator
Copy Link

Plan reference: 20-massnahmenplan.md -> P1-3
ADR: ADR 0024
Effort: M (2 AT)
Depends on: #218, #219

Context

This is the issue that turns the airgap story from plausible into
verified — the plan's reason for pulling P1-3 forward. It also answers the
plan's open question "what breaks without internet access", which is not
answerable by reading code.

Current state

  • Existing strengths to confirm rather than build: no telemetry, no update
    checks, no CDNs, self-hosted fonts (ADR 0016), CSP default-src 'self',
    Postgres full-text search instead of an external engine, drawio vendored
    (§0.2).
  • Whether an egress-blocked deployment is fully functional has never been
    tested — the open question in 20-massnahmenplan.md.

Acceptance criteria

  • A full deployment runs with egress blocked: install, first-run setup,
    login, editing with live collaboration, search, upload, all export
    formats (PDF via Gotenberg, DOCX/ODT via pandoc), backup and restore.
  • Every outbound connection attempt is captured and listed; each is
    either eliminated or documented as required with its purpose.
  • Behaviour of outbound e-mail (SMTP) without egress is stated
    explicitly — it is the one connection an authority may or may not
    permit.
  • A written protocol (date, environment, versions by digest, results,
    deviations) exists as assessor-facing evidence.
  • Findings feed back into #221 and #229.

Out of scope

Fixing whatever the run uncovers — that becomes its own issue, referenced
from here.

**Plan reference:** `20-massnahmenplan.md` -> P1-3 **ADR:** ADR 0024 **Effort:** M (2 AT) **Depends on:** #218, #219 ## Context This is the issue that turns the airgap story from plausible into verified — the plan's reason for pulling P1-3 forward. It also answers the plan's open question "what breaks without internet access", which is not answerable by reading code. ## Current state - Existing strengths to confirm rather than build: no telemetry, no update checks, no CDNs, self-hosted fonts (ADR 0016), CSP `default-src 'self'`, Postgres full-text search instead of an external engine, drawio vendored (§0.2). - Whether an egress-blocked deployment is fully functional has never been tested — the open question in `20-massnahmenplan.md`. ## Acceptance criteria - [ ] A full deployment runs with egress blocked: install, first-run setup, login, editing with live collaboration, search, upload, all export formats (PDF via Gotenberg, DOCX/ODT via pandoc), backup and restore. - [ ] Every outbound connection attempt is captured and listed; each is either eliminated or documented as required with its purpose. - [ ] Behaviour of outbound e-mail (SMTP) without egress is stated explicitly — it is the one connection an authority may or may not permit. - [ ] A written protocol (date, environment, versions by digest, results, deviations) exists as assessor-facing evidence. - [ ] Findings feed back into #221 and #229. ## Out of scope Fixing whatever the run uncovers — that becomes its own issue, referenced from here.
fable-5 added this to the M28 — VS-NfD: offline/airgap deployment milestone 2026-07-30 01:43:50 +02:00
fable-5 added the
effort:M
area:supply-chain
vs-nfd
 labels 2026-07-30 01:43:50 +02:00
fable-5 commented 2026-07-31 17:27:42 +02:00
Author
Collaborator
Copy Link

Done via PR #290 (merged after PR #289, CI run 619 green, CD 622 deployed Test+Int, readyz fully green on both).

All acceptance criteria met — evidence: docs/vs-nfd/97-isolationslauf-protokoll.md:

  • Full deployment with egress blocked (internal: true networks): setup, login, live collaboration, search, upload, MD/DOCX/PDF exports via the sidecars, backup and restore.
  • Complete tcpdump capture on both bridges: zero packets leave the isolated subnets; the single outbound attempt the application makes is SMTP.
  • SMTP behaviour stated explicitly: enqueue 204, delivery fails contained in the outbox (EAI_AGAIN, 5 retries, then FAILED), instance stays fully functional.
  • Findings fed back: #288 (fixed in the same chain), #221 (same environment reused for the update rehearsal), #229 (handbook airgap section updated).
  • Plan checkbox P1-3 and open question I-28 ticked.
Done via PR #290 (merged after PR #289, CI run 619 green, CD 622 deployed Test+Int, readyz fully green on both). All acceptance criteria met — evidence: `docs/vs-nfd/97-isolationslauf-protokoll.md`: - Full deployment with egress blocked (`internal: true` networks): setup, login, live collaboration, search, upload, MD/DOCX/PDF exports via the sidecars, backup and restore. - Complete tcpdump capture on both bridges: zero packets leave the isolated subnets; the single outbound attempt the application makes is SMTP. - SMTP behaviour stated explicitly: enqueue 204, delivery fails contained in the outbox (EAI_AGAIN, 5 retries, then FAILED), instance stays fully functional. - Findings fed back: #288 (fixed in the same chain), #221 (same environment reused for the update rehearsal), #229 (handbook airgap section updated). - Plan checkbox P1-3 and open question I-28 ticked.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels   
area:auth

   
area:docs

   
area:export

   
area:ops

   
area:storage

   
area:supply-chain

   
auth

Authentication, permissions, quotas

  
backend

API server (apps/api)

  
blocked

Blocked on external dependency/infrastructure

  
collab

Collaboration server (apps/collab)

  
deployment

Docker, CI/CD, hosting

  
docs

Documentation

  
effort:L

   
effort:M

   
effort:S

   
frontend

SPA (apps/web)

  
plugins

Plugin system and SDK

  
qa

Tests, fixtures, e2e

  
vs-nfd

   
vs-nfd:blocker
No Label
area:auth
area:docs
area:export
area:ops
area:storage
area:supply-chain
auth
backend
blocked
collab
deployment
docs
effort:L
effort:M
effort:S
frontend
plugins
qa
vs-nfd
vs-nfd:blocker
Milestone
Clear milestone
No items
No Milestone
M28 — VS-NfD: offline/airgap deployment
Projects
Clear projects
No project
Assignees
Clear assignees
No Assignees
1 Participants
Notifications
Due Date
The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: stwaidele/dorfteich#220
No description provided.
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?