Secure by Design

Frontdown is built from the ground up with security in mind. This document outlines how its secure-by-design architecture protects sensitive data while enabling seamless backup and restore functionality.

Core Security Principles

1. User-Centric Security: All critical actions are tied to the user being logged in, ensuring no unauthorized access.
2. Decentralized Sensitive Data: Sensitive data like credentials and keys are never stored in the central database.
3. Keepass Integration: A Keepass database acts as the single source of truth for sensitive information, ensuring it remains encrypted and secure.
4. Dynamic Credential Generation: Backup passwords and repository credentials are dynamically generated and stored securely.

Authentication Workflow

Frontdown uses user authentication as the foundation for its security model. The system ensures that only authenticated users can interact with their environments.

graph TD
    User[User Logs In] -->|Credentials Verified| Core[Frontdown Core]
    Core -->|Access Granted| Dashboard[User Dashboard]
    Dashboard -->|Manage Backups| Keepass[Keepass Database]
    Keepass -.->|Securely Stores| SensitiveData[Passwords & Keys]

Sensitive Data Storage

Sensitive information is never directly stored in the Frontdown database. Instead, the system only keeps pointers to paths while the actual data remains encrypted in the Keepass database.

graph TD
    Database[Frontdown Database]
    Database -->|Stores Only Paths| Core[Frontdown Core]
    Core -.->|No Sensitive Data| Keepass[Keepass Database]
    Keepass -->|Encrypted Storage| SensitiveData[Passwords & Keys]

Backup Agent Deployment

When deploying a new backup agent, the system dynamically generates a repository password by accessing the user’s Keepass database. This ensures that sensitive data is securely handled and isolated.

graph TD
    User[User Action]
    User -->|Deploy Agent| Core[Frontdown Core]
    Core -->|Opens| Keepass[Keepass Database]
    Keepass -->|Generates| RepoPassword[Repository Password]
    Core -->|Deploys| Agent[Backup Agent]
    Agent -->|Stores| Providers[Storage Providers]

Data Backup and Restore

Frontdown ensures backups are stored securely and can be restored without exposing sensitive data.

graph TD
    Agent[Backup Agent] -->|Backs Up Data| Providers[Storage Providers]
    Providers -->|Stores Encrypted Data| SecureStorage[Encrypted Backup Storage]
    SecureStorage -.->|Restores Data| Agent

Key Design Highlights

• Dynamic Credentials: Repository passwords are dynamically created during agent deployment, ensuring unique and secure credentials.
• Keepass-Centric Storage: All sensitive information is kept encrypted in the Keepass database.
• Limited Database Access: The Frontdown database only contains metadata and paths, ensuring that sensitive data remains inaccessible.
• User-Centric Authentication: Actions are gated by the user’s login session.

Benefits of Secure-by-Design Architecture

1. Maximum Security: No sensitive data is exposed to the system or external attackers.
2. User Control: Users retain full ownership and control over their credentials and sensitive information.
3. Scalability: Designed to work seamlessly across homelab setups and larger enterprise environments.
4. Compliance Ready: Aligns with best practices for data security and encryption.

Frontdown’s secure-by-design architecture ensures peace of mind, allowing you to focus on your work while knowing your backups are protected at every step.