Testing a self-hosted document system with outbound internet blocked
Inventory network dependencies and test complete document workflows under the actual allowed routes of an isolated environment.
Enable the intended network restrictions and test the whole workflow from clean browsers and fresh workers. A local application can still fetch fonts, authentication metadata, or other runtime resources externally. Build the dependency inventory by requester and direction, including callbacks and storage retrieval.
List dependencies by phase and requester
Separate build time downloads, installation prerequisites, runtime requests, maintenance operations, and optional telemetry. Record the owner, destination, protocol, and purpose of each dependency. Include DNS, time synchronization, certificate validation, licensing mechanisms if applicable, identity services, and object storage. Verify product specific requirements from authoritative deployment documentation rather than inferring them from a local installation package. This inventory helps distinguish a dependency that can be packaged in advance from a service that must remain reachable whenever users open or save documents.
| Requester | Dependency to verify from that location |
|---|---|
| Browser | Host assets, editor origin, authentication, fonts, and downloads |
| Application service | Identity validation, session setup, database, and storage access |
| Processing worker | Source retrieval, required runtime assets, and result storage |
| External integration | The documented callback route into the application |
For each route, record the hostname, port, protocol, trust requirements, and operational owner. Avoid replacing this inventory with an unrestricted bidirectional rule. A source URL can resolve differently across zones, and a certificate trusted by a browser may be missing from the worker's trust store.
Keep installation and runtime dependencies separate. Preloading packages can solve a build-time requirement but says nothing about authentication renewal a week later. Include certificate rotation, supported license renewal where applicable, upgrades, and restore procedures in the operating plan. If any required service remains external, state that dependency explicitly and test its failure behavior instead of describing the deployment as fully disconnected.
Verify every participating network zone
The browser, application backend, editor service, conversion workers, and storage may use different routes and trust stores. Validate connectivity from each actual requester. A browser reaching the storage URL does not prove a worker can resolve the same host or trust its certificate. Include reverse callbacks and asynchronous result retrieval. Use the environment's normal DNS names and certificates, because temporary host overrides or bypassed TLS checks can conceal deployment defects. Record the expected direction of every request so firewall rules reflect real ownership rather than a broad bidirectional exception.
Caches can hide accidental external requests
Inspect runtime requests during representative workflows and identify external assets or endpoints that are not part of the approved design. Replace or configure them only through supported deployment mechanisms. Cache warmup can hide a dependency, so include clean browser profiles and freshly started workers in acceptance. Also test expired credentials and cold certificate or metadata caches where relevant. If a required external dependency cannot be removed, document the route and availability requirement honestly instead of describing the deployment as fully isolated because its main application server is local.
Maintain the accepted route inventory
- Maintain a directional dependency inventory for runtime and maintenance.
- Test with cold caches and the actual outbound restrictions enabled.
- Verify callbacks, storage retrieval, and authentication renewal from their real services.
- Document the offline update and certificate rotation process.
- Retain evidence of denied unexpected connections and their resolution.
Run the cold-start workflow under the real policy
In a controlled test environment, enforce the intended outbound network policy, start fresh workers, and use a clean browser to import, preview, edit, save, and export a synthetic file. Restart one service and repeat the recovery path. Inspect denied connections alongside application traces. A font request or authentication metadata refresh may appear only during this cold path. Record each failure and its owning component, then rerun the same sequence after configuration changes. Preserve the approved network policy throughout final acceptance rather than temporarily opening all outbound access.
Document backup and restore: metadata, files, permissions, and pending jobs
Test recovery of metadata, stored bytes, versions, permissions, and integration mappings as one coherent document state.
Read story
Self-hosted document licensing: questions to resolve before purchase
Normalize pricing units, deployment rights, optional modules, support coverage, and renewal assumptions before comparing proposals.
Read story
Private cloud collaboration: who operates and owns each part?
Write a responsibility model for infrastructure, document state, privileged access, maintenance, and recovery.
Read story