System Architecture & Security Model

AlphaDrive is architected around the principles of simplicity, zero external dependencies, minimal memory footprint, and defense-in-depth security.

---

1. Key Architecture Pillars

Single Binary Philosophy

AlphaDrive embeds all HTML templates, stylesheets, scripts, and vector icons directly into the Go executable via embed.FS. Deploying or upgrading AlphaDrive requires swapping a single binary.

Embedded SQLite Engine

Instead of requiring MySQL or PostgreSQL containers:

• Uses modern pure-Go SQLite with Write-Ahead Logging (WAL).
• Full ACID transactional guarantees with high concurrent read throughput.
• Foreign keys and automatic database schema migrations on boot.

Opaque Content-Addressed Storage

Uploaded files are never saved with user-supplied filenames on the host filesystem:

• Each uploaded file is hashed and assigned a secure UUID/hash storage key.
• Stored in sharded directories (objects/ab/abcdef...).
• Eliminates path traversal vulnerabilities, shell injection, and filename encoding issues.

---

2. Security Architecture

1. Argon2id Password Hashing: State-of-the-art password hashing with high memory-hardness protection against GPU/ASIC cracking.
2. Double-Submit CSRF Protection: All state-modifying requests (POST, PUT, DELETE) require a matching X-CSRF-Token header.
3. Least-Privilege Systemd Sandboxing: Runs as an unprivileged system user with ProtectSystem=strict, ProtectHome=true, and NoNewPrivileges=true.
4. Timing-Safe Authentication: Constant-time token comparisons to mitigate side-channel timing attacks.
5. Secure HTTP Headers: Automatic X-Content-Type-Options: nosniff, X-Frame-Options: SAMEORIGIN, and Referrer-Policy: strict-origin-when-cross-origin.