stwaidele/dorfteich
1
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases 22 Wiki Activity

[VS-NfD] Write the hardening guide with a "VS-NfD operation" reference configuration #227

New Issue
Closed
opened 2026-07-30 01:43:56 +02:00 by fable-5 · 3 comments
fable-5 commented 2026-07-30 01:43:56 +02:00
Collaborator
Copy Link

Plan reference: 20-massnahmenplan.md -> Phase 5
ADR: ADR 0019
Effort: L (3 AT)
Depends on: #191, #192, #200, #216

Context

One named configuration an operator can adopt wholesale is worth more than
a list of options. It is also the artefact that makes the switches built in
M1/M2/M4 auditable.

Current state

  • docs/self-hosting/README.md covers ordinary self-hosting; no hardened
    profile exists.
  • Existing switches that belong in the profile: api.enabled (default
    off), mcp.enabled (default off), upload.svgPolicy,
    upload.allowedExtensions, backup settings — all in
    apps/api/src/settings/instance-settings.service.ts.

Acceptance criteria

  • A complete reference configuration for VS-NfD operation: local auth
    off, public API off, MCP off, feeds off, plugins off, backup local
    only — each with the exact setting name and value.
  • Every entry states why, so an operator can deviate knowingly.
  • Settings added by M1/M2/M4 are included; the guide is updated in the
    same PR as each new switch (stated as a rule, not a hope).
  • A verification script or checklist lets an operator confirm the
    profile is active on a running instance.
  • Cross-referenced from #226 and #230.

Out of scope

Hardening the operator's platform (OS, network, reverse proxy).

**Plan reference:** `20-massnahmenplan.md` -> Phase 5 **ADR:** ADR 0019 **Effort:** L (3 AT) **Depends on:** #191, #192, #200, #216 ## Context One named configuration an operator can adopt wholesale is worth more than a list of options. It is also the artefact that makes the switches built in M1/M2/M4 auditable. ## Current state - `docs/self-hosting/README.md` covers ordinary self-hosting; no hardened profile exists. - Existing switches that belong in the profile: `api.enabled` (default off), `mcp.enabled` (default off), `upload.svgPolicy`, `upload.allowedExtensions`, backup settings — all in `apps/api/src/settings/instance-settings.service.ts`. ## Acceptance criteria - [ ] A complete reference configuration for VS-NfD operation: local auth off, public API off, MCP off, feeds off, plugins off, backup local only — each with the exact setting name and value. - [ ] Every entry states **why**, so an operator can deviate knowingly. - [ ] Settings added by M1/M2/M4 are included; the guide is updated in the same PR as each new switch (stated as a rule, not a hope). - [ ] A verification script or checklist lets an operator confirm the profile is active on a running instance. - [ ] Cross-referenced from #226 and #230. ## Out of scope Hardening the operator's platform (OS, network, reverse proxy).
fable-5 added this to the M30 — VS-NfD: compliance documentation milestone 2026-07-30 01:43:56 +02:00
fable-5 added the
effort:L
area:docs
vs-nfd
 labels 2026-07-30 01:43:56 +02:00
fable-5 commented 2026-07-31 05:00:15 +02:00
Author
Collaborator
Copy Link

For the hardening guide, from #200 (PR #260): the VS-NfD reference configuration sets the instance setting plugins.enabled = false. Effect: every plugin surface answers 404 (admin install/list/mode, pond plugin list and activation, sandbox frame and asset routes); the dropzone watcher quarantines dropped ZIPs instead of installing; existing plugin blocks render their declared fallback; the editor offers no plugin blocks. The switch is flipped in the Site-Admin settings panel and, like every instance setting, is cached in-process - follow the flip with an api restart. Reference: docs/architecture/plugin-architecture.md, Lifecycle section. Related master switches for the same configuration: api.enabled=false (default), mcp.enabled=false (default), feeds.enabled=false (set explicitly - default is on).

For the hardening guide, from #200 (PR #260): the VS-NfD reference configuration sets the instance setting plugins.enabled = false. Effect: every plugin surface answers 404 (admin install/list/mode, pond plugin list and activation, sandbox frame and asset routes); the dropzone watcher quarantines dropped ZIPs instead of installing; existing plugin blocks render their declared fallback; the editor offers no plugin blocks. The switch is flipped in the Site-Admin settings panel and, like every instance setting, is cached in-process - follow the flip with an api restart. Reference: docs/architecture/plugin-architecture.md, Lifecycle section. Related master switches for the same configuration: api.enabled=false (default), mcp.enabled=false (default), feeds.enabled=false (set explicitly - default is on).
fable-5 commented 2026-07-31 07:38:10 +02:00
Author
Collaborator
Copy Link

Supply for the hardening guide from M26 (#213): new instance setting classification.uploadPolicy = warn | block (default warn). It governs file uploads to VS-NfD-classified pages: warn shows the persistent notice in the attachments panel (file inherits the level, content carries no marking), block rejects such uploads server-side (403 classified_upload_blocked). The VS-NfD reference configuration should set block. Related M26 settings for the reference configuration: classification.newPageDefault = vs_nfd (every new page starts marked, #204).

Supply for the hardening guide from M26 (#213): new instance setting classification.uploadPolicy = warn | block (default warn). It governs file uploads to VS-NfD-classified pages: warn shows the persistent notice in the attachments panel (file inherits the level, content carries no marking), block rejects such uploads server-side (403 classified_upload_blocked). The VS-NfD reference configuration should set block. Related M26 settings for the reference configuration: classification.newPageDefault = vs_nfd (every new page starts marked, #204).
fable-5 commented 2026-07-31 10:57:45 +02:00
Author
Collaborator
Copy Link

Done in commit 2c6eff8 (branch PR #275; landed via the green chain runs 579-582 with the merges of #273/#274/#276/#277 - #275 itself was closed with a pointer after its solo run hit the documented runner infra signature and the chain was rebased).

Evidence against the acceptance criteria:

  • Complete adoptable reference configuration in docs/vs-nfd/50-haertungsleitfaden.md: instance settings (registration closed, api/mcp off as defaults, feeds and plugins explicitly off, classification.newPageDefault=vs_nfd, classification.uploadPolicy=block, svg reject, minimal extension list, nextcloud off, retention defaults, legal pages) AND deploy level (BACKUP_ALLOWED_TARGETS empty = backup local only, enforced outside Site-Admin reach; sessions 12h/2h; SMTP deliberately unconfigured with the consequence stated honestly) - every entry with exact name, value, default and WHY.
  • auth.local.enabled listed as the pending row (arrives with #216, compensation until then stated; the row is armed in the #216 PR).
  • Binding rule stated: every new switch updates the guide in the same PR.
  • Verification: four unauthenticated 404 curls + readyz + Site-Admin spot checks as a repeatable checklist.
  • Cross-referenced from the delimitation statement (#226 doc, file names made concrete) and consumed as product evidence by the Grundschutz mapping (#230).
Done in commit 2c6eff8 (branch PR #275; landed via the green chain runs 579-582 with the merges of #273/#274/#276/#277 - #275 itself was closed with a pointer after its solo run hit the documented runner infra signature and the chain was rebased). Evidence against the acceptance criteria: - Complete adoptable reference configuration in docs/vs-nfd/50-haertungsleitfaden.md: instance settings (registration closed, api/mcp off as defaults, feeds and plugins explicitly off, classification.newPageDefault=vs_nfd, classification.uploadPolicy=block, svg reject, minimal extension list, nextcloud off, retention defaults, legal pages) AND deploy level (BACKUP_ALLOWED_TARGETS empty = backup local only, enforced outside Site-Admin reach; sessions 12h/2h; SMTP deliberately unconfigured with the consequence stated honestly) - every entry with exact name, value, default and WHY. - auth.local.enabled listed as the pending row (arrives with #216, compensation until then stated; the row is armed in the #216 PR). - Binding rule stated: every new switch updates the guide in the same PR. - Verification: four unauthenticated 404 curls + readyz + Site-Admin spot checks as a repeatable checklist. - Cross-referenced from the delimitation statement (#226 doc, file names made concrete) and consumed as product evidence by the Grundschutz mapping (#230).
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels   
area:auth

   
area:docs

   
area:export

   
area:ops

   
area:storage

   
area:supply-chain

   
auth

Authentication, permissions, quotas

  
backend

API server (apps/api)

  
blocked

Blocked on external dependency/infrastructure

  
collab

Collaboration server (apps/collab)

  
deployment

Docker, CI/CD, hosting

  
docs

Documentation

  
effort:L

   
effort:M

   
effort:S

   
frontend

SPA (apps/web)

  
plugins

Plugin system and SDK

  
qa

Tests, fixtures, e2e

  
vs-nfd

   
vs-nfd:blocker
No Label
area:auth
area:docs
area:export
area:ops
area:storage
area:supply-chain
auth
backend
blocked
collab
deployment
docs
effort:L
effort:M
effort:S
frontend
plugins
qa
vs-nfd
vs-nfd:blocker
Milestone
Clear milestone
No items
No Milestone
M30 — VS-NfD: compliance documentation
Projects
Clear projects
No project
Assignees
Clear assignees
No Assignees
1 Participants
Notifications
Due Date
The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: stwaidele/dorfteich#227
No description provided.
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?