# Security — Zammad

> **Terakhir Diperbarui:** 2026-07-02

---

## Prinsip

1. **Secret tidak masuk Git** — `.env`, token API, LDAP password, OSS secret hanya di server
2. **Bucket private** — `zammad-attachments` tanpa public ACL; akses via Zammad S3 credential saja
3. **HTTPS wajib** — UI/API publik lewat nginx + wildcard SSL `*.gisportal.id`
4. **LDAP bind** — gunakan service account dedicated jika memungkinkan (bukan Administrator produksi)
5. **API token FE** — scope minimal; rotasi jika bocor

---

## Credential map

| Secret | Lokasi | Jangan commit |
|--------|--------|---------------|
| Zammad `.env` | `/opt/stacks/zammad/.env` | ✅ |
| OSS keys (reuse) | `/opt/stacks/geonet-console/.env` | ✅ |
| PostgreSQL password | `.env` Zammad + backup vault | ✅ |
| Zammad API token (FE) | Zammad admin + FE `.env` terpisah | ✅ |

---

## Network

| Arah | Port | Catatan |
|------|------|---------|
| Internet → nginx → Zammad | 443 | Hanya reverse proxy |
| Zammad → PostgreSQL | 5432 | Internal LAN 10.100.1.25 |
| Zammad → LDAP | 389 | AD 10.100.1.40 |
| Zammad → OSS | 8010 | HTTP internal (bukan publik) |

---

## Hardening (post-install)

- [ ] Nonaktifkan signup publik (hanya LDAP)
- [ ] Rate limit nginx pada `/api/v1/`
- [ ] Backup DB terenkripsi + retention policy
- [ ] Audit log Zammad untuk perubahan role/group

---

## Referensi

- LDAP policy: [`server-connection/docs/adr/ADR-0003-ldap-authentication.md`](../../server-connection/docs/adr/ADR-0003-ldap-authentication.md)
- OSS: [`docs/adr/ADR-0002-oss-attachments-qnap.md`](adr/ADR-0002-oss-attachments-qnap.md)