Prerequisites
- App running on ThinkCentre via Docker
- You have shell access
Steps / checklist
- [ ] LUKS (or equiv) active on Docker/data volume (
lsblk,cryptsetup status) - [ ] Postgres not published to
0.0.0.0(compose ports internal or 127.0.0.1 only) - [ ] Friend URL is HTTPS or Tailscale — not raw
http://192.168…for real data - [ ]
.envmode600; not in git - [ ] Two test accounts: A seed/stats invisible to B
- [ ]
psql:sealed_payloadnot human-readable health numbers - [ ] Browser Network tab:
/api/statsis ciphertext until client unlock - [ ] Ingest wrong key → 401
- [ ] Backups encrypted if any exist
- [ ] Privacy + consent pages reachable
- [ ] Automated isolation/E2EE unit tests green
Verification
All boxes checked → proceed to SAAS-Lifebot/runbooks/friend-invite-and-consent.
Rollback
Do not invite; fix failing control first.
Compiled from
wiki/projects/SAAS-Lifebot/runbooks/pre-invite-security-gate.md · git is the source of truth