Year: 2026
Type: article
Abstract: Resource-constrained publishers need a public origin, an editorial pipeline, and administrative access without relying on a commercial Zero-Trust Network Access service. We describe a split-plane pattern, termed infrastructure-aware Zero Trust architecture (IA-ZTA), deployed for the LyndHub news portal. A public virtual private server operates as a replaceable production replica, while ingest and administration run on a Jakarta Kubernetes cluster behind carrier-grade network address translation and without node External-IP assignments. The control plane initiates WireGuard promotion sessions, and new sessions from the replica toward the control plane are dropped. Bidirectional probes conducted during system validation supported this directional policy. In a same-host laboratory comparison, an official OWASP Core Rule Set Nginx image and a honeypot front both produced zero false positives on 80 benign portal paths; their true-positive rates on 14 reconnaissance paths were 0.21 and 0.50, respectively, without a statistically significant paired difference (exact McNemar p = 0.125). Separately, 41,247 published identifiers and 4.54 GiB of uploads were copied to empty storage in 183 s while the public site remained available. The architecture limits, but does not eliminate, the consequences of public-replica compromise.
Source: Scientific Reports
Author: Parlindungan Tampubolon
Institution: Universitas 17 Agustus 1945 Jakarta
Language: English
Subfield: Library and Information Sciences
Field: Social Sciences
Domain: Social Sciences
Open Access status: gold
Estimated APC paid: $2,690
OpenAlex ID: W7212190417