dorfteich/docs/vs-nfd
Claude Fable 5 a758c9d78b
All checks were successful
CI / Lint, typecheck, test (pull_request) Successful in 6m45s
CI / Build container images (pull_request) Successful in 1m14s
CI / Auth e2e pack (pull_request) Successful in 8m37s
CI / Import/export fidelity gate (pull_request) Successful in 57s
CD / Build and push images (push) Successful in 21s
CD / Deploy to Test (push) Successful in 12s
CD / Smoke tests against Test (push) Successful in 1m16s
CD / Promote to Int (push) Successful in 28s
CI / Lint, typecheck, test (push) Successful in 6m19s
CI / Build container images (push) Has been skipped
CI / Auth e2e pack (push) Successful in 8m12s
CI / Import/export fidelity gate (push) Successful in 58s
#219: verified reproducible build without network access
The ADR 0024 §4 decision, taken explicitly and both ways: customers
OPERATE prebuilt digest-pinned images (no customer-side build), and
ADDITIONALLY the workspace build is verified to work with networking
disabled - so site-local patching stays possible without internet.

Evidence (docs/vs-nfd/96-offline-build-protokoll.md): pnpm install
--offline --frozen-lockfile plus pnpm build under docker run
--network none (node:22.15.1-alpine + pnpm 11.9.0, the pinned
toolchain), reproduced twice from clean checkouts with identical
results. The offline kit is the pnpm store (~870 MB) plus the build
user's ~/.cache (~460 MB - the prisma engines live there; without the
cache the prisma postinstall fails offline).

The one network dependency found and bounded: the drawio plugin's
installable ZIP fetches its pinned vendor tarball on first build.
Deploy images contain no plugin ZIPs, so the delivery-relevant build is
fully offline (CI=1 skips the fetch, as in CI); an offline ZIP build
pre-seeds the tarball into packages/plugins/drawio/vendor/.

Also catches up the operations manual's scheduler-job table to 10
(read-trail-maintenance was added in #224 without the row here).

Refs #219.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AUtYMxwTCMHG9mVHnwbFg8
2026-07-31 14:39:35 +02:00
..
00-analyse-auftrag.md docs: VS-NfD readiness planning (ist-aufnahme, plan, ADRs 0019-0026, issue drafts) 2026-07-30 01:48:05 +02:00
10-ist-aufnahme.md docs: VS-NfD readiness planning (ist-aufnahme, plan, ADRs 0019-0026, issue drafts) 2026-07-30 01:48:05 +02:00
20-massnahmenplan.md #219: verified reproducible build without network access 2026-07-31 14:39:35 +02:00
30-issue-adr-auftrag.md docs: VS-NfD readiness planning (ist-aufnahme, plan, ADRs 0019-0026, issue drafts) 2026-07-30 01:48:05 +02:00
31-issue-entwurf.md docs: VS-NfD readiness planning (ist-aufnahme, plan, ADRs 0019-0026, issue drafts) 2026-07-30 01:48:05 +02:00
40-abgrenzungserklaerung.md #227: hardening guide with the VS-NfD reference configuration 2026-07-31 10:35:26 +02:00
50-haertungsleitfaden.md #217: map IdP groups and roles onto the permission model 2026-07-31 13:09:11 +02:00
60-sicherheitsdokumentation.md #215: trusted reverse-proxy header / mTLS client-certificate path 2026-07-31 12:50:09 +02:00
70-betriebshandbuch.md #219: verified reproducible build without network access 2026-07-31 14:39:35 +02:00
80-grundschutz-mapping.md #230: IT-Grundschutz mapping for APP.3.1 and CON.11.1 2026-07-31 10:35:26 +02:00
90-restrisiken.md #216: hard AUTH_LOCAL_ENABLED switch over every local credential flow 2026-07-31 12:58:07 +02:00
95-mirror-protokoll.md #218: mirror procedure into an internal registry 2026-07-31 14:33:04 +02:00
96-offline-build-protokoll.md #219: verified reproducible build without network access 2026-07-31 14:39:35 +02:00