docs(adr): give ADR-0008's SSO deferral an expiry (#103) - #277
Merged
Conversation
ADR-0008 defers Authelia knowingly and records why, but records no condition for ending it. A deferral with no end condition and a decision never to do the thing are the same document six months later. ADR-0022 ends it on a state rather than a date: the first real secret, photo or document in the sensitive tier, any reachability from outside the house, or a third account holder — whichever comes first. Expiry means a decision gets recorded, not that Authelia gets deployed; re-accepting is allowed, drifting is what the trigger removes. Checking ADR-0008's stated substitute for SSO against the actual service list is most of what this was. Per-application TOTP exists on Vaultwarden, Paperless-ngx and Home Assistant, and on none of Grafana, Immich or AdGuard Home — Grafana OSS has no MFA in any edition, Immich's upstream has declined it and points at OAuth, and AdGuard has one password-only admin. Grafana is the only one of the six deployed, so the thing offered in place of SSO has never been available here, and for those three an identity provider is the only route to a second factor rather than a heavier alternative to one. ADR-0008 is not superseded and not amended — ADR-0001 keeps it immutable — so its SSO paragraph gets a forward pointer and nothing else. security.md's single MFA line is replaced with the per-service split, and the roadmap moves #103 into Security with the two things it puts on #102's build: TOTP enrolment on the three that can carry it, and the mini PC's disk encryption decided there rather than inherited from prometheus. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
There was a problem hiding this comment.
🟢 Approval recommended
The changes are documentation-only, internally consistent, and the links/wording reviewed align with the stated intent of adding a state-based expiry to the SSO deferral.
Pull request overview
This PR updates the repository’s security decision recordkeeping around SSO/MFA by adding an explicit “expiry condition” for ADR-0008’s SSO deferral, and propagating that condition into the security and roadmap documentation so it remains actionable as the estate evolves.
Changes:
- Add ADR-0022 defining state-based triggers that force revisiting the SSO deferral (without mandating deployment).
- Add a forward pointer from ADR-0008 to ADR-0022 while keeping ADR-0008’s reasoning immutable.
- Update
docs/security.mdanddocs/roadmap.mdto reflect the per-service MFA reality and the new expiry conditions.
File summaries
| File | Description |
|---|---|
| docs/security.md | Replaces the single “no MFA” statement with a per-service breakdown and links the new expiry conditions. |
| docs/roadmap.md | Moves #103 into Security with its resolved shape, and updates related roadmap text to reflect the state-based expiry. |
| docs/adr/0022-expire-the-sso-deferral-when-the-tier-holds-real-data.md | New ADR defining the SSO deferral expiry triggers and documenting per-service MFA availability constraints. |
| docs/adr/0008-place-services-by-data-trust.md | Adds a minimal forward pointer to ADR-0022 without altering ADR-0008’s original decision text. |
Review details
- Files reviewed: 4/4 changed files
- Comments generated: 0
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #103.
ADR-0008 defers Authelia knowingly and records why — two users, no external exposure, per-application TOTP is proportionate. What it does not record is when the deferral stops being the right answer. A deferral with no end condition and a decision never to do the thing are the same document six months later, and by then nobody remembers which one was meant.
What this adds
ADR-0022 ends the deferral on a state, not a date — nothing about this risk is driven by the calendar, and an arbitrary date is a deadline everyone learns to move. Three triggers, whichever comes first:
Expiry means a decision gets recorded, not that Authelia gets deployed. Re-accepting the deferral is a legitimate outcome — it is what happened once already. What the trigger removes is the third option, which is arriving at the same place by never looking.
What checking the premise turned up
ADR-0008 offered per-application TOTP in place of SSO. Read against the services that actually authenticate a person, that substitute exists for half of them:
django-allauthTwo things follow. For those three an identity provider is the only route to a second factor, not a heavier alternative to one. And Grafana is the only one of the six deployed today, so the substitute ADR-0008 named has never existed in this estate —
security.md's "no MFA on the internal services" is not a gap awaiting a decision there, it is a standing property until an IdP exists.Changes
docs/adr/0022-…(new) — the expiry, the per-service table, and the floor due before ADR-0008: the sensitive-tier services and two new firewall rules are untracked #102's tier holds anything: TOTP enrolled on the three that can carry it, Immich and AdGuard named insecurity.mdas unable to, and the mini PC's disk encryption decided at build time rather than inherited fromprometheus.docs/adr/0008-…— a forward pointer only. ADR-0001 keeps ADRs immutable, so this is neither superseded nor amended; the reasoning is untouched.docs/security.md— the single MFA line replaced with the per-service split and the expiry.docs/roadmap.md— ADR-0008 defers SSO knowingly — give the deferral an expiry #103 moves into Security with its shape, the Decided but not built stub points there, and the ADR-0008: the sensitive-tier services and two new firewall rules are untracked #102 entry now says the SSO it does not get is deferred until this box holds real data rather than indefinitely.Nothing here changes a rule, a container or a byte of configuration.
make validatepasses — 2 skips, both "not the deployment host".🤖 Generated with Claude Code