FFDB Docs
FFDBInstallOpen portal
Operations›Production security

Production security

Preserve FFDB's trust boundaries when deploying it behind your own network and storage providers.

Harden the production boundary

Production security is the deployment checklist for preserving FFDB's documented trust boundaries.

Self-hosting makes network, secret, storage, proxy, backup, and operational controls part of the product boundary.

Use it before admitting untrusted traffic, after topology changes, and during every release review.

Requirements for Production security

  • Prerequisite — Completed architecture, configuration, backup, and observability decisions.
  • Prerequisite — An owner for threat review, incident response, patching, and secret rotation.
  • Required value — Exact public/trusted proxy origins, private network allowlists, storage paths, provider endpoints, independent secrets, and resource limits.
  • Required value — Evidence for RLS, auth, storage, sync, backup, and restore acceptance.

Deployment checklist

  • Terminate TLS and configure an exact trusted proxy boundary.
  • Keep PostgreSQL, worker IPC, project files, and backup volumes off public networks.
  • Use HTTPS allowlisted S3 endpoints and keep the internal endpoint distinct from the browser-visible endpoint.
  • Rotate platform, project, JWT, storage-grant, cursor, and backup secrets independently.
  • Review the threat model and run the release checklist before changing a trust-boundary crate.

Verify the exposed boundary

Run these checks from the host and repeat the HTTPS checks from an external operator network. Expected results are a loopback-only gateway, no public PostgreSQL or Axum listener, healthy dependencies, and restrictive ownership on configuration and durable data.

Linux hostsh
docker compose ps
ss -lntp | grep -E ':(5173|8080|5432|9000|9001|8025|1025)\b'
curl --fail --include http://127.0.0.1:5173/readyz
curl --fail --include http://127.0.0.1:5173/openapi.json >/dev/null

# Managed installation configuration must be operator-readable only.
sudo stat -c '%a %U:%G %n' /etc/ffdb/ffdb.env
sudo ffdb-host verify

Production security workflow

  • 1. Verify TLS and the trusted proxy boundary.
  • 2. Restrict PostgreSQL, worker IPC, project files, backups, metrics, and provider credentials.
  • 3. Confirm exact S3 endpoint and browser-origin controls.
  • 4. Run security and isolation acceptance for the release.
  • 5. Record residual risks and rollback authority.

Verify production security

The deployed system matches the threat model and no undocumented convenience path bypasses authorization or isolation.

Troubleshoot production security

  • A service needs broad root/capability access — stop and redesign the permission boundary.
  • A control is assumed because of a certification claim — replace it with tested evidence; FFDB claims no formal certification.

Continue from Production security

  • Run the manual acceptance plan.
  • Schedule key rotation and restore exercises.