stwaidele/dorfteich
1
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases 22 Wiki Activity
69563348ca
dorfteich/docs/architecture/adr/0026-backup-target-restriction.md
Claude Fable 5 404a3741c8
All checks were successful
CI / Auth e2e pack (pull_request) Successful in 8m34s
Details
CI / Import/export fidelity gate (pull_request) Successful in 57s
Details
CI / Lint, typecheck, test (pull_request) Successful in 6m19s
Details
CI / Build container images (pull_request) Successful in 1m14s
Details
CD / Build and push images (push) Successful in 17s
Details
CD / Deploy to Test (push) Successful in 15s
Details
CD / Smoke tests against Test (push) Successful in 1m16s
Details
CD / Promote to Int (push) Successful in 12s
Details
CI / Lint, typecheck, test (push) Successful in 6m25s
Details
CI / Build container images (push) Has been skipped
Details
CI / Auth e2e pack (push) Successful in 8m24s
Details
CI / Import/export fidelity gate (push) Successful in 59s
Details
ADRs 0019-0027: accepted after explicit operator review (2026-07-31) 
Stefan reviewed and accepted all nine VS-NfD ADRs one by one. Two
adjustments from the review: ADR 0021 decision 3 now states the #216
refinement in the decision itself (PAT/feed-token issuance stays
available to IdP-authenticated sessions — API authorization under its
own switches, not interactive sign-in) instead of contradicting the
later Decisions section; and the ADR 0020 dual-verify window will be
removed early (issue #296) rather than waiting for its stated expiry.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AUtYMxwTCMHG9mVHnwbFg8
2026-07-31 20:47:27 +02:00

2.4 KiB
Raw Blame History

ADR 0026: Backup target restriction

  • Status: accepted (2026-07-31)
  • Date: 2026-07-29

Context

Backups are the largest single egress path in the system: the entire content of the instance, in one artefact. Today the remote destination is a freely configurable WebDAV/Nextcloud URL in instance_settings, validated as a URL but not restricted to any host, plus an rsync mirror to a private host (ADR 0015, issue #84). Anyone with Site-Admin can therefore direct a full copy of the instance to an arbitrary server.

The tempting answer is to encrypt backups in the application. ADR 0019 rules that out: media protection is the platform's base function, and implementing it here would move Dorfteich into the certification obligation under §51 VSA.

Decision

  1. A deploy-level allowlist constrains permissible backup destinations. Deploy-level, not a runtime setting, so a compromised Site-Admin account cannot widen it.
  2. An empty allowlist disables every remote target — WebDAV and rsync mirror alike. "Local only" is the VS-NfD reference configuration.
  3. The admin UI distinguishes "unavailable" from "unconfigured", so an operator is never left guessing whether a missing backup is a misconfiguration or policy.
  4. No application-side backup encryption, following ADR 0019. Backup media are protected by the platform.
  5. Integrity of backup artefacts is in scope, unlike their confidentiality: checksums let a restore be verified, which is an application concern because only we know what the artefact should contain (see #199 for the same reasoning on attachments).

Consequences

  • Existing deployments that use a remote target must have it added to the allowlist, or backups stop. This is a breaking change and is called out in the release notes.
  • The delimitation statement (#226) must state plainly that backups leave the application unencrypted and that media protection is the operator's duty. That sentence will be read closely; it is the correct one.
  • Off-site backup in an airgapped deployment becomes an operator process (media handling), not an application feature.
  • Restore stays unchanged, including the maintenance-mode interlock that closes collab sessions during a restore.

Implementing issues

#192 (allowlist + deploy-level disable). Related: #199 (integrity hashes), #229 (backup/restore chapter of the operations manual).