Security and trust model
Self-hosting moves important decisions from a vendor to the operator. Jiandu makes those decisions explicit: which process owns the installation, which proxy may speak for a browser, where secrets live, which external systems receive data, and who can open an exceptional document.
Default trust boundary
The default profile listens on 127.0.0.1, uses local disk and SQLite, sends no remote telemetry, and enables no external identity provider, connector, or plugin. That is an evaluation boundary, not a remote-access configuration.
For household access, put an HTTPS reverse proxy in front of a private Jiandu listener. Jiandu validates the configured public origin and the proxy's directly observed network address. Publishing the backend HTTP port, trusting broad proxy ranges, or accepting arbitrary forwarded headers weakens the boundary the application expects.
Identities and credentials
Use a credential for one purpose only:
| Credential | Intended use | Handling rule |
|---|---|---|
| Owner recovery token | Break-glass installation recovery | Protect the live file, retain a separate failure-independent offline copy, and do not use it for daily work |
| Human session | Browser access for one named person | Revoke after device loss or account changes |
| Personal access token | Scoped automation | Expire it, name the integration, and keep it in a secret store |
| Provider or storage secret | OIDC, LDAP, proxy, storage, or connector integration | Use the supported secret-reference or credential mechanism; never put the value inline in Jiandu JSON |
| Passkey | Optional human sign-in | Register to the intended local account and keep a recovery path |
External authentication proves identity; authorization remains local to Jiandu. OIDC, LDAP/AD, and trusted-proxy assertions resolve to a local account rather than importing a provider's permissions wholesale.
Authorization model
- Member is the normal household role.
- Administrator manages the installation but does not implicitly see all restricted documents.
- Owner is the durable recovery authority.
- Groups and custom permission sets model recurring responsibilities.
- Document grants restrict an exceptional record to named people or groups as Viewer, Editor, or Manager.
The safest verification uses two accounts: make the change as a manager, then confirm the actual result as an ordinary Member. An administrator's screen cannot prove that a denied user is denied.
Optional outbound trust
S3-compatible storage, WebDAV, OIDC, LDAP, OTLP telemetry, email connectors, and plugins are opt-in. Each adds another system that can observe metadata, receive content, impersonate a source, or affect availability. Enable one integration at a time, scope its credentials and network path, and test both failure and revocation.
Plugins are an expert feature with reduced—not perfect—isolation. Remote OCR is not supported by the household profile. The optional local OCR worker is not an advertised end-to-end recognition guarantee.
What Jiandu cannot protect against
Jiandu cannot recover data that was never backed up, make a compromised host trustworthy, correct a broadly scoped object-store credential, or turn ignored certificate warnings into secure transport. It also cannot prove a deployment is production-ready merely because the readiness endpoint is green.
Use protect your data, network access and HTTPS, and the deployment checklist to turn this model into operating controls.