stwaidele/dorfteich
1
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases 22 Wiki Activity

[VS-NfD] Define the deployment hardening-profile mode and the machine-readable VS-NfD configuration catalog #243

New Issue
Closed
opened 2026-07-30 11:59:31 +02:00 by fable-5 · 1 comment
fable-5 commented 2026-07-30 11:59:31 +02:00
Collaborator
Copy Link

Plan reference: follow-up to the M24/M25 switches; requested by the operator 2026-07-30
ADR: to be written (proposed) as part of this issue
Effort: M (2-3 AT)
Depends on: -

Context

Operators deploying for VS-NfD need the application itself to know which configuration options violate the reference profile - and deployments outside any VS context must stay entirely unaffected. A deploy-level mode decides how the UI treats profile-violating options: shown but marked, hidden (and the hiding marked), or rejected outright. Deploy-level (env), not a runtime setting, for the same reason as BACKUP_ALLOWED_TARGETS (#192): a compromised Site-Admin account must not be able to widen it.

Current state

  • Instance switches exist or are planned: api.enabled (#104), mcp.enabled (#105), feeds.enabled (#191), plugins.enabled (#200), auth.local.enabled (#216), upload.svgPolicy, remote backup targets (#192). Nothing marks them as VS-NfD-relevant.
  • The reference configuration lives only in the hardening guide (#227) as prose; the application cannot answer whether the running configuration matches it.

Acceptance criteria

  • Env VS_NFD_MODE with values off | marked | hidden | enforced, default off (option d: VS-NfD is not a topic, no marking anywhere), validated in the shared env schema, passed through compose, documented in .env.example.
  • A machine-readable catalog (shared package) lists every profile-relevant setting with its compliant value and the hardening-guide reference; a fence test keeps catalog and hardening guide (#227) from drifting.
  • The active mode and the catalog verdict for the current configuration are exposed to the web app and shown in the admin settings view.
  • An ADR (proposed) records the mode model, the catalog as single source of truth, and why off is the default.
  • This issue alone changes no UI behaviour beyond displaying the mode - the treatments land in the three follow-up issues.

Out of scope

The UI treatments (follow-up issues), and any change to switch defaults.

**Plan reference:** follow-up to the M24/M25 switches; requested by the operator 2026-07-30 **ADR:** to be written (proposed) as part of this issue **Effort:** M (2-3 AT) **Depends on:** - ## Context Operators deploying for VS-NfD need the application itself to know which configuration options violate the reference profile - and deployments outside any VS context must stay entirely unaffected. A deploy-level mode decides how the UI treats profile-violating options: shown but marked, hidden (and the hiding marked), or rejected outright. Deploy-level (env), not a runtime setting, for the same reason as `BACKUP_ALLOWED_TARGETS` (#192): a compromised Site-Admin account must not be able to widen it. ## Current state - Instance switches exist or are planned: `api.enabled` (#104), `mcp.enabled` (#105), `feeds.enabled` (#191), `plugins.enabled` (#200), `auth.local.enabled` (#216), `upload.svgPolicy`, remote backup targets (#192). Nothing marks them as VS-NfD-relevant. - The reference configuration lives only in the hardening guide (#227) as prose; the application cannot answer whether the running configuration matches it. ## Acceptance criteria - [ ] Env `VS_NFD_MODE` with values `off | marked | hidden | enforced`, default `off` (option d: VS-NfD is not a topic, no marking anywhere), validated in the shared env schema, passed through compose, documented in `.env.example`. - [ ] A machine-readable catalog (shared package) lists every profile-relevant setting with its compliant value and the hardening-guide reference; a fence test keeps catalog and hardening guide (#227) from drifting. - [ ] The active mode and the catalog verdict for the current configuration are exposed to the web app and shown in the admin settings view. - [ ] An ADR (proposed) records the mode model, the catalog as single source of truth, and why `off` is the default. - [ ] This issue alone changes no UI behaviour beyond displaying the mode - the treatments land in the three follow-up issues. ## Out of scope The UI treatments (follow-up issues), and any change to switch defaults.
fable-5 added this to the M32 - VS-NfD: deployment profile & UI modes milestone 2026-07-30 11:59:31 +02:00
fable-5 added the
effort:M
vs-nfd
area:ops
 labels 2026-07-30 11:59:31 +02:00
fable-5 commented 2026-07-31 19:06:36 +02:00
Author
Collaborator
Copy Link

Done via PR #292 (merged, CI run 627 green, CD 629 deployed Test+Int, readyz fully green on both).

All acceptance criteria met: VS_NFD_MODE env (off default, shared-schema-validated, compose + .env.example), machine-readable catalog in packages/shared/src/vs-nfd-profile.ts with the fence test against 50-haertungsleitfaden.md (pattern #201), mode + verdict exposed on GET /admin/system/vs-nfd-profile and shown in the admin settings view (card renders only when mode is not off), ADR 0027 (proposed). No UI behaviour beyond display.

Done via PR #292 (merged, CI run 627 green, CD 629 deployed Test+Int, readyz fully green on both). All acceptance criteria met: `VS_NFD_MODE` env (off default, shared-schema-validated, compose + `.env.example`), machine-readable catalog in `packages/shared/src/vs-nfd-profile.ts` with the fence test against `50-haertungsleitfaden.md` (pattern #201), mode + verdict exposed on `GET /admin/system/vs-nfd-profile` and shown in the admin settings view (card renders only when mode is not off), ADR 0027 (proposed). No UI behaviour beyond display.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels   
area:auth

   
area:docs

   
area:export

   
area:ops

   
area:storage

   
area:supply-chain

   
auth

Authentication, permissions, quotas

  
backend

API server (apps/api)

  
blocked

Blocked on external dependency/infrastructure

  
collab

Collaboration server (apps/collab)

  
deployment

Docker, CI/CD, hosting

  
docs

Documentation

  
effort:L

   
effort:M

   
effort:S

   
frontend

SPA (apps/web)

  
plugins

Plugin system and SDK

  
qa

Tests, fixtures, e2e

  
vs-nfd

   
vs-nfd:blocker
No Label
area:auth
area:docs
area:export
area:ops
area:storage
area:supply-chain
auth
backend
blocked
collab
deployment
docs
effort:L
effort:M
effort:S
frontend
plugins
qa
vs-nfd
vs-nfd:blocker
Milestone
Clear milestone
No items
No Milestone
M32 - VS-NfD: deployment profile & UI modes
Projects
Clear projects
No project
Assignees
Clear assignees
No Assignees
1 Participants
Notifications
Due Date
The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: stwaidele/dorfteich#243
No description provided.
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?