Inventory & Assessment — et-lager MongoDB Atlas vs Security Standards
Issue: #2737 · Status: Design (inventory + assessment) · Batch: K (#3338)
et-lager uses a MongoDB Atlas cluster (nextjs-db-dev.ncgd33w.mongodb.net) that is separate from
rs0 and outside our managed VPS estate. This doc inventories it and assesses it against p24-infra
security standards. Operational detail already lives in
docs/et-lager-operations.md (audited 2026-07-03) — this is the security
assessment and remediation plan, not a duplicate.
1. Resource summary
| Attribute | Value |
|---|---|
| Cluster | nextjs-db-dev.ncgd33w.mongodb.net (MongoDB Atlas) |
| Role | Secondary store for et-lager — processed invoice state, protocol positions, missing-product tracking |
| Relation to rs0 | None — separate cluster, not a voting/arbiter member of rs0 |
| App | et-lager (Next.js 15 on Vercel), gitlab.com/pinbox24/et-lager |
Registered in dev_r_services? | No |
2. Assessment vs p24-infra security standards
| Standard | Status | Finding |
|---|---|---|
| No hardcoded credentials in source | ❌ FAIL | #2703 — MongoDB creds hardcoded in GitLab source (CRITICAL) |
| No unauthenticated proxy endpoints | ❌ FAIL | #2704 — /api/public/intercars-proxy is an unauthenticated SSRF vector |
| Automated backup + tested restore | ⚠️ GAP | Atlas free tier — point-in-time restore disabled, no automated backup |
Registered in dev_r_services | ❌ FAIL | not present in the compliance registry |
| Documented operations doc | ✅ PASS | docs/et-lager-operations.md exists and is current |
| Credential-isolation policy coverage | ⚠️ GAP | Atlas cluster not listed in credential-isolation-policy.md exceptions |
3. Remediation plan (priority order)
- #2703 — hardcoded MongoDB credentials (CRITICAL, blocking). Move to Vercel env vars; rotate the exposed credential (Atlas → Database Access → edit user → new password). Rotation is a secret-manager action; the SOPS/Vercel wiring must land before the GitLab source is scrubbed. Scrub the value from GitLab history.
- #2704 — unauthenticated SSRF proxy. Require the Pinbox24 JWT on
/api/public/intercars-proxy(match the other authenticated proxy routes) or allowlist the single upstream host. Implementation in the et-lager repo (Next.js worker), not here. - Backup. Free tier has no automated backup. Options: (a) upgrade the cluster to a tier with PITR;
(b) nightly
mongodump→ Wasabip24-infravia a cron following the Error Notification Standard. Recommend (b) as the cheaper interim; document RPO/RTO. - Register in
dev_r_services(category='database',compliance_workbook,workbook_url→docs/et-lager-operations.md) — secret-manager / admin write. - Policy — add the Atlas cluster to
credential-isolation-policy.mdexceptions with its rotation owner and cadence.
4. Cross-cutting note
et-lager is a thin BFF — almost every route proxies the caller’s Pinbox24 JWT upstream (see the ops doc architecture diagram). The Atlas store is secondary state, so a leak there is lower blast-radius than the Pinbox24 API, but the hardcoded-credential finding (#2703) is still critical because the same pattern could expose higher-value secrets.
5. Ownership & out of scope
This doc is inventory + assessment. The credential rotation (#2703), dev_r_services write, and policy
edits are secret-manager / admin work; the SSRF fix (#2704) is et-lager repo implementation. No
credential value is read or displayed here (cluster host is a public DNS name, not a secret).
Design-only deliverable. Related: docs/et-lager-operations.md, issues #2703, #2704, docs/policies/ credential-isolation.