1.7 KiB
1.7 KiB
Threat model
Protected assets
- File contents, metadata, previews, and replacement-recovery blobs.
- Password, sessions, TOTP secrets, recovery codes, API tokens, share tokens, and OnlyOffice secrets.
- Database-to-object mapping, backup data, and blob manifests.
Trust boundaries
- Browser to Nginx Proxy Manager to Drive HTTP service.
- Drive to PostgreSQL on the private container network.
- Drive to managed cache/array mounts.
- Drive to the existing OnlyOffice Document Server.
- Public-link visitors to explicitly shared resources.
- Read-only importer mounts to managed Drive storage.
Primary threats
- Unclaimed-instance takeover before first-run setup.
- Session theft, CSRF, credential guessing, token leakage, and proxy-address spoofing.
- Path traversal, symlink following, MIME confusion, malicious previews, and archive expansion.
- SSRF or forged OnlyOffice callbacks.
- Stale writes, duplicate requests, interrupted commits, and premature GC.
- Secret disclosure through logs, images, configuration, backups, or repository history.
Phase 0 controls
- Production setup must finish before proxy exposure; setup is disabled atomically after owner creation.
- Secrets are environment/file inputs and ignored by Git.
- Non-root container, explicit mounts, private PostgreSQL network, and health endpoints.
- Architectural boundaries prevent HTTP code from reaching database or managed storage directly.
- Security headers, CSRF, authentication, rate limits, scoped tokens, and callback validation are implemented with their Phase 1 features.
Review this document whenever a new external integration, public endpoint, preview processor, or authentication mechanism is introduced.