autorecon/lifecycle-and-vulnerability-management.md

Internet-Facing Stack Lifecycle & Vulnerability Management

Last updated: 2026-04-07 (UTC)

1) Internet-facing application inventory (app, version, image digest)

Source of truth for internet-facing targets: results/* host folders and their WhatWeb outputs.
Operational owner must replace all TBD digest values with runtime evidence from docker image inspect/docker ps --no-trunc.

Host/FQDN	Product/App	Deployed version evidence	Container image (repo:tag)	Image digest (sha256)	Evidence source
auth.lan.ddnsgeek.com	Authelia (auth portal)	Version not fingerprinted from external scan	TBD	TBD	results/auth.../tcp_443_https_whatweb.txt
edge.lan.ddnsgeek.com	Edge reverse-proxy/app entrypoint	Version not fingerprinted from external scan	TBD	TBD	results/edge.../tcp_443_https_whatweb.txt
familytree.lan.ddnsgeek.com	FamilyTree app (gunicorn-backed)	gunicorn detected, app version not fingerprinted	TBD	TBD	results/familytree.../tcp_443_https_whatweb.txt
gitea.lan.ddnsgeek.com	Gitea	Gitea detected; exact version not fingerprinted	TBD	TBD	results/gitea.../tcp_443_https_whatweb.txt
gotify.lan.ddnsgeek.com	Gotify	Version not fingerprinted from external scan	TBD	TBD	results/gotify.../tcp_443_https_whatweb.txt
grafana.lan.ddnsgeek.com	Grafana	Grafana login redirect observed; exact version not fingerprinted	TBD	TBD	results/grafana.../tcp_443_https_whatweb.txt
influxdb.lan.ddnsgeek.com	InfluxDB (behind auth)	Version not fingerprinted from external scan	TBD	TBD	results/influxdb.../tcp_443_https_whatweb.txt
kuma.lan.ddnsgeek.com	Uptime Kuma	Dashboard redirect observed; exact version not fingerprinted	TBD	TBD	results/kuma.../tcp_443_https_whatweb.txt
monitor-kuma.lan.ddnsgeek.com	Uptime Kuma (monitoring endpoint)	Dashboard redirect observed; exact version not fingerprinted	TBD	TBD	results/monitor-kuma.../tcp_443_https_whatweb.txt
nextcloud.lan.ddnsgeek.com	Nextcloud (Apache/PHP stack)	Apache 2.4.66, PHP 8.3.30	TBD	TBD	results/nextcloud.../tcp_443_https_whatweb.txt
node-red.lan.ddnsgeek.com	Node-RED (behind auth)	Version not fingerprinted from external scan	TBD	TBD	results/node-red.../tcp_443_https_whatweb.txt
passbolt.lan.ddnsgeek.com	Passbolt	NGINX detected; exact Passbolt version not fingerprinted	TBD	TBD	results/passbolt.../tcp_443_https_whatweb.txt
portainer.lan.ddnsgeek.com	Portainer	Portainer detected; exact version not fingerprinted	TBD	TBD	results/portainer.../tcp_443_https_whatweb.txt
prometheus.lan.ddnsgeek.com	Prometheus (behind auth)	Version not fingerprinted from external scan	TBD	TBD	results/prometheus.../tcp_443_https_whatweb.txt
searxng.lan.ddnsgeek.com	SearXNG	searxng/2026.4.5+474b0a55b detected	TBD	TBD	results/searxng.../tcp_443_https_whatweb.txt
shifts.lan.ddnsgeek.com	Shifts app (nginx front-end)	nginx 1.29.7	TBD	TBD	results/shifts.../tcp_443_https_whatweb.txt
stockfill.lan.ddnsgeek.com	Stockfill app (nginx front-end)	nginx 1.27.5	TBD	TBD	results/stockfill.../tcp_443_https_whatweb.txt
traefik.lan.ddnsgeek.com	Traefik (behind auth)	Version not fingerprinted from external scan	TBD	TBD	results/traefik.../tcp_443_https_whatweb.txt

Required evidence commands (run on Docker host)

# Capture deployed containers with immutable image digest references
sudo docker ps --format '{{.Names}}\t{{.Image}}' --no-trunc

# Resolve image digests for inventory table
sudo docker image inspect <image:tag> --format '{{index .RepoDigests 0}}'

# Optional: export inventory as CSV for compliance tracking
sudo docker ps --format '{{.Names}},{{.Image}}' --no-trunc > internet-facing-runtime-images.csv

---

2) Monthly update window definition

Standard cadence

• Window: Second Tuesday of every month, 02:00–06:00 UTC.
• Fallback window: Second Wednesday of every month, 02:00–06:00 UTC.
• Emergency patch window (critical CVE only): within 48 hours of advisory triage.

Scope per window

1. OS packages (host + VM base images): apply security and bugfix updates.
2. Container base images: rebuild/pull fresh immutable digests.
3. Application releases: patch/minor upgrades for internet-facing apps.

Freeze and exception policy

• No deferral beyond one cycle without documented risk acceptance.
• Critical internet-facing CVEs (remote exploitable) cannot wait for the next regular window.

---

3) Pre-production smoke checks for critical apps

All updates must be promoted through pre-prod first. Minimum smoke checks:

Nextcloud

• Login page loads.
• Test user login succeeds.
• File upload + download round trip succeeds.
• Background jobs/cron status healthy.

Passbolt

• Login page loads.
• Browser extension/API auth succeeds.
• Secret create/read/update works for test vault.
• Email/notification queue healthy.

Gitea

• Login succeeds.
• Repository clone + push with test repo succeeds.
• Webhook test delivery succeeds.
• Actions/runner (if enabled) executes sample workflow.

Grafana

• Login succeeds.
• Datasource health checks pass.
• Key dashboards render without panel errors.
• Alert rule evaluation pipeline healthy.

Shared gate for all critical apps

• HTTPS endpoint returns expected status.
• No new high/critical findings in pre-prod vulnerability scan.
• Error budget/SLO smoke threshold respected for 30 minutes post-deploy.

---

4) CVE advisory tracking mapped to deployed versions

Create/maintain a single register (cve-register.csv or ticket board) with these required fields:

• Product
• Deployed version
• Deployed image digest
• CVE ID
• CVSS score/severity
• Advisory source URL
• Affected version range
• Exploit status (known exploited: yes/no)
• Mitigation owner
• Target fix version
• Due date
• Status (Open / In-progress / Pending validation / Resolved)

Advisory sources (minimum)

• Vendor advisories/release notes for each product (Nextcloud, Passbolt, Gitea, Grafana, etc.)
• NVD
• CISA KEV catalog (for known exploited CVEs)

Mapping rule

A CVE can only be marked “Not Affected” when the deployed version + digest is proven outside vulnerable ranges with evidence attached.

---

5) Closure evidence requirement (hard gate)

A vulnerability ticket is only closed when both conditions are met:

1. Version or digest changed in production
   • Before/after evidence attached (docker image inspect, deployment manifest diff, or SBOM diff).
2. Post-update scan is clean for that CVE
   • Re-scan target service and attach artifact proving CVE no longer detected.

Mandatory closure artifacts

• Screenshot/export of runtime version and image digest after deployment.
• Linked change request/deployment ID.
• Post-update vulnerability scan report.
• Smoke-test checklist execution evidence.

Status workflow

Open -> Planned -> In Progress -> Pending Validation -> Resolved

Resolved is prohibited unless both hard-gate conditions above are satisfied.