Claude Fable 5
404a3741c8
All checks were successful
CI / Auth e2e pack (pull_request) Successful in 8m34s
CI / Import/export fidelity gate (pull_request) Successful in 57s
CI / Lint, typecheck, test (pull_request) Successful in 6m19s
CI / Build container images (pull_request) Successful in 1m14s
CD / Build and push images (push) Successful in 17s
CD / Deploy to Test (push) Successful in 15s
CD / Smoke tests against Test (push) Successful in 1m16s
CD / Promote to Int (push) Successful in 12s
CI / Lint, typecheck, test (push) Successful in 6m25s
CI / Build container images (push) Has been skipped
CI / Auth e2e pack (push) Successful in 8m24s
CI / Import/export fidelity gate (push) Successful in 59s
Stefan reviewed and accepted all nine VS-NfD ADRs one by one. Two adjustments from the review: ADR 0021 decision 3 now states the #216 refinement in the decision itself (PAT/feed-token issuance stays available to IdP-authenticated sessions — API authorization under its own switches, not interactive sign-in) instead of contradicting the later Decisions section; and the ADR 0020 dual-verify window will be removed early (issue #296) rather than waiting for its stated expiry. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AUtYMxwTCMHG9mVHnwbFg8
54 lines
2.4 KiB
Markdown
54 lines
2.4 KiB
Markdown
# ADR 0026: Backup target restriction
|
|
|
|
- Status: accepted (2026-07-31)
|
|
- Date: 2026-07-29
|
|
|
|
## Context
|
|
|
|
Backups are the largest single egress path in the system: the entire
|
|
content of the instance, in one artefact. Today the remote destination is a
|
|
freely configurable WebDAV/Nextcloud URL in `instance_settings`, validated
|
|
as a URL but not restricted to any host, plus an rsync mirror to a private
|
|
host (ADR 0015, issue #84). Anyone with Site-Admin can therefore direct a
|
|
full copy of the instance to an arbitrary server.
|
|
|
|
The tempting answer is to encrypt backups in the application. ADR 0019
|
|
rules that out: media protection is the platform's base function, and
|
|
implementing it here would move Dorfteich into the certification
|
|
obligation under §51 VSA.
|
|
|
|
## Decision
|
|
|
|
1. **A deploy-level allowlist constrains permissible backup
|
|
destinations.** Deploy-level, not a runtime setting, so a compromised
|
|
Site-Admin account cannot widen it.
|
|
2. **An empty allowlist disables every remote target** — WebDAV and rsync
|
|
mirror alike. "Local only" is the VS-NfD reference configuration.
|
|
3. **The admin UI distinguishes "unavailable" from "unconfigured"**, so an
|
|
operator is never left guessing whether a missing backup is a
|
|
misconfiguration or policy.
|
|
4. **No application-side backup encryption**, following ADR 0019. Backup
|
|
media are protected by the platform.
|
|
5. **Integrity of backup artefacts is in scope**, unlike their
|
|
confidentiality: checksums let a restore be verified, which is an
|
|
application concern because only we know what the artefact should
|
|
contain (see #199 for the same reasoning on attachments).
|
|
|
|
## Consequences
|
|
|
|
- Existing deployments that use a remote target must have it added to the
|
|
allowlist, or backups stop. This is a breaking change and is called out
|
|
in the release notes.
|
|
- The delimitation statement (#226) must state plainly that backups leave
|
|
the application unencrypted and that media protection is the operator's
|
|
duty. That sentence will be read closely; it is the correct one.
|
|
- Off-site backup in an airgapped deployment becomes an operator process
|
|
(media handling), not an application feature.
|
|
- Restore stays unchanged, including the maintenance-mode interlock that
|
|
closes collab sessions during a restore.
|
|
|
|
## Implementing issues
|
|
|
|
#192 (allowlist + deploy-level disable). Related: #199 (integrity
|
|
hashes), #229 (backup/restore chapter of the operations manual).
|