Servers and service boundaries

Service roles

The download mirror is a regional option for OS and app files. It does not replace connectivity checks, time or positioning services. Staging is a test environment, not another consumer download region.

Authoritative DNS is provided by INWX. DiamaneOS does not operate its own authoritative nameserver network. The privacy policy describes the providers and data involved in requests.

Phone or browser

• PrimaryWebsite and network services
• Download regionOS and app files
• AttestationVerification and account state

Staging has separate test endpoints. Public service hosts do not hold production release-signing keys.

Host and service isolation

Hosts use Debian with separate service accounts. Public ingress and forwarding are denied unless explicitly allowed. Administration uses an authenticated WireGuard management tunnel; direct public SSH and password SSH are disabled.

Systemd constrains service filesystems, capabilities, devices, memory and processes. Serving accounts cannot rewrite their code, configuration or public files. Network egress is restricted by service identity and destination; a failed policy refresh does not grant unrestricted access.

These controls reduce attack surface. A virtual server’s firewall cannot prevent every attack against the provider’s network, and separate accounts on one host are not separate kernels. A hosting provider remains inside the trust boundary for its virtual machines.

Website and relays

The website serves static HTML and CSS with local fonts and images. It runs no scripts, analytics or third-party embeds. TLS protects browser connections, and content security policy limits what a page can load or submit.

The contact form has separate ingress and mail workers. Input size, methods and request rates are bounded. The mail worker has a fixed sender, destination and SMTP route. Contact text is not stored as a web-server submission history.

Connectivity checks return the response Android expects. Positioning and provisioning relays have fixed upstream destinations; they are not open proxies. Assistance-data caches contain shared responses rather than a history of individual users’ requests.

Request access logs and request-associated error logs are disabled. Temporary abuse controls use memory. Operational logs have a short volatile retention policy. Providers can still observe connections and keep their own records; this setup does not make IP addresses anonymous.

Downloads and attestation

Download servers serve static artifacts. Artifact authenticity depends on independent signature verification, rather than trusting the server that supplies a file. A valid signature does not conceal your IP address, requested file or download time from the host.

Attestation has a separate stateful service. Its database resides on encrypted storage with no plaintext fallback. Storage encryption protects locked state; it does not hide data from a running application or a compromised host while that state is unlocked.

Staging and recovery

Staging uses separate publication roots and TLS material. It does not contain the production database or production signing keys. Its public preview is excluded from crawlers; crawler rules are not access control.

Source configuration can recreate services, but it cannot recreate database history or host secrets. A usable recovery also needs authenticated encrypted backups, independent keys and a restore test. Replicas and source repositories alone are not backups of application state.

Configuration source

• Infrastructure contains the Debian host and service adapters.
• Network services contains the GrapheneOS-derived connectivity and relay configuration.
• Release serving and Apps serving contain download configuration.
• AttestationServer contains the remote verification service.
• Website contains these pages and the contact handler.

DiamaneOS adapts GrapheneOS’s public service code and configuration. The Debian adapters and project changes have their own review scope; using upstream code is not a claim that GrapheneOS audited this deployment.