docs(adrs): add encryption & secrets-management ADR set (ADR-023…029) - #154
Merged
Conversation
Add seven ADRs addressing the encryption-secrets-adr-prompt, plus a README index update: - ADR-023 — Database encryption at rest (LUKS2 under Postgres + SierraDB + Garage; dumps/snapshots re-encrypted) - ADR-024 — Database encryption in transit (native TLS + self-hosted step-ca; stunnel sidecar for SierraDB, flagged "assume") - ADR-025 — HTTPS edge (Caddy with built-in ACME; api Docker-internal only) - ADR-026 — Arch Linux VPS hardening baseline (nftables, key-only SSH, userns-remap, auditd, honest manual weekly patching SLA) - ADR-027 — Secrets vault for external credentials (HashiCorp Vault; events carry only vault_key_id references; crypto-shredding exit ramp) - ADR-028 — Access control for the Costume Designer / Costume Assistant Settings Aggregates view (// AUTHZ-GATE: capability + INSERT-only audit) - ADR-029 — GDPR Art. 17 right-to-erasure in an append-only event-sourced system (crypto-shred + tombstone projection delete + retention/compaction) README.md gains the seven new rows; the attribution note is extended to cover the ADR-023…029 co-authorship with glm-5.2 (neuralwatt). Co-authored-by: glm-5.2 (neuralwatt)
This was referenced Aug 1, 2026
…ge in-transit TLS ADR-023 — resolve the "assume" flag on Garage at-rest capability using the upstream encryption cookbook: Garage v1.0.1 stores object bytes in plaintext (no SSE-S3); LUKS is the only Garage-native at-rest path and is what we ship. SSE-C is documented as optional defense-in-depth, scoped to a separate code-change follow-up. ADR-024 — Garage has no built-in TLS on its S3 endpoint (confirmed upstream). Add the API↔Garage link to the in-transit decision: front Garage with the Caddy reverse proxy (ADR-025) on a Docker-internal TLS port, pinned step-ca root; Garage's plaintext :3900 stays Docker-internal only. Startup config check extended to reject an http:// S3_ENDPOINT in production. Co-authored-by: glm-5.2 (neuralwatt)
13 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds seven Architecture Decision Records covering encryption, secrets management, and GDPR erasure for
breakdown-rs, produced in response tobackend/prompts/encryption-secrets-adr-prompt.md. Each ADR recommends one concrete open-source, docker-compose-hostable primary tool and marks others as alternatives, per the prompt's constraints (no paid SaaS, no manual user-side setup, EventStore carries only secret references).ADRs
pg_dump/snapshots re-encryptedstep-ca;stunnelsidecar for SierraDB (flagged assume)apiis Docker-internal onlyuserns-remap,auditd, honest manual weekly patching SLAvault_key_idreferences; crypto-shredding exit rampsettings:manage_external_credentialscapability for Costume Designer + Costume Assistant,// AUTHZ-GATE:in-handler pattern + INSERT-only auditKey honest caveats (called out rather than glossed)
tqwewe/sierradb:0.3.1→stunnelsidecar recommended until confirmed.Role naming
Uses the codebase's English domain language from
crates/core/src/membership/mod.rs(Role::CostumeDesigner,Role::CostumeAssistant) rather than the German terms, with the German gloss kept parenthetically where it aids readability. Both Costume Designer and Costume Assistant may save external credentials (GDrive / AI tokens) per ADR-027/028.Index
backend/docs/architecture/adrs/README.mdgains the seven new rows and extends the attribution note to cover the ADR-023…029 co-authorship.Pre-commit checks
Co-authored-by: glm-5.2 (neuralwatt)