38 lines
2 KiB
Markdown
38 lines
2 KiB
Markdown
# Threat model
|
|
|
|
## Protected assets
|
|
|
|
- File contents, metadata, previews, and replacement-recovery blobs.
|
|
- Password, sessions, TOTP secrets, recovery codes, API tokens, share tokens, and OnlyOffice secrets.
|
|
- Database-to-object mapping, backup data, and blob manifests.
|
|
|
|
## Trust boundaries
|
|
|
|
- Browser to Nginx Proxy Manager to Drive HTTP service.
|
|
- Drive to PostgreSQL on the private container network.
|
|
- Drive to managed cache/array mounts.
|
|
- Drive to the existing OnlyOffice Document Server.
|
|
- Public-link visitors to explicitly shared resources.
|
|
- Read-only importer mounts to managed Drive storage.
|
|
- Future WebDAV/rclone credentials to an explicitly granted Drive subtree and action set.
|
|
|
|
## Primary threats
|
|
|
|
- Unclaimed-instance takeover before first-run setup.
|
|
- Session theft, CSRF, credential guessing, token leakage, and proxy-address spoofing.
|
|
- Path traversal, symlink following, MIME confusion, malicious previews, and archive expansion.
|
|
- SSRF or forged OnlyOffice callbacks.
|
|
- Over-broad, leaked, or revoked integration credentials and protocol gateways that bypass application services.
|
|
- Stale writes, duplicate requests, interrupted commits, and premature GC.
|
|
- Secret disclosure through logs, images, configuration, backups, or repository history.
|
|
|
|
## Phase 0 controls
|
|
|
|
- Production setup must finish before proxy exposure; setup is disabled atomically after owner creation.
|
|
- Secrets are environment/file inputs and ignored by Git.
|
|
- Non-root container, explicit mounts, private PostgreSQL network, and health endpoints.
|
|
- Architectural boundaries prevent HTTP code from reaching database or managed storage directly.
|
|
- Security headers, CSRF, authentication, rate limits, scoped tokens, and callback validation are implemented with their Phase 1 features.
|
|
- Phase 1 credentials are independently revocable and may be restricted by subtree and action; future gateways must use them and the canonical mutation path.
|
|
|
|
Review this document whenever a new external integration, public endpoint, preview processor, or authentication mechanism is introduced.
|