coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

ssh-certificates pack: use ops-warden's rehearsal config (WARDEN_CONFIG); record dry-run
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: sonnet
Assistant-Process: 6969@bnt-lap001
Assistant-Session: e8ae73f2-8385-4c9c-b714-94c3c52cdbc0
This commit is contained in:
tegwick 2026-10-02 22:01:44 +02:00
parent 8091016bb3
commit 2f48c9df8d
2 changed files with 20 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

17
runbooks/ssh-certificates/pack.yaml
View file

@ -22,6 +22,13 @@ datapoints:
help: "Actor type prefix decides the maximum TTL: adm 48h, agt 24h, atm 8h. agt-rehearsal is an inert test actor (2h, a principal no host trusts); use your own actor for real access."
dimensions: {actor: operator, kind: identity, subsystem: ops-warden}
ask_in: ready
- id: warden_config
label: warden config file
type: path
default: ~/.config/warden/rehearsal/warden.yaml
help: The rehearsal config uses a throwaway local CA that nothing trusts and has no flex-auth gate, so it proves the signing mechanics, not the policy gate. For real access use your production config, ~/.config/warden/warden.yaml.
dimensions: {actor: operator, kind: location, subsystem: ops-warden}
ask_in: ready
- id: pubkey
label: Public key path
type: path
@ -62,7 +69,8 @@ stages:
actor: operator
owner: ops-warden
requires: [prerequisites]
command: warden status
uses: [warden_config]
command: WARDEN_CONFIG={{warden_config}} warden status
idempotent: idempotent
verify:
done_when: You know which certificates are current and which are expired
@ -76,8 +84,8 @@ stages:
title: Sign a public key for the actor
actor: operator
owner: ops-warden
uses: [actor_name, pubkey]
command: warden sign {{actor_name}} --pubkey {{pubkey}} > /tmp/{{actor_name}}-cert.pub
uses: [actor_name, pubkey, warden_config]
command: WARDEN_CONFIG={{warden_config}} warden sign {{actor_name}} --pubkey {{pubkey}} > /tmp/{{actor_name}}-cert.pub
idempotent: idempotent
idempotent_note: Each run issues a new certificate and overwrites the file; the old one expires on its own.
rollback: Delete /tmp/{{actor_name}}-cert.pub; the certificate expires on its own.
@ -143,7 +151,8 @@ stages:
actor: operator
owner: ops-warden
requires: [tunnel-up]
command: warden log | tail -5
uses: [warden_config]
command: WARDEN_CONFIG={{warden_config}} warden log | tail -5
idempotent: idempotent
verify:
done_when: Your signing appears in the history

7
workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md
View file

@ -106,6 +106,13 @@ holds no NetKingdom pack, so it is not T05 evidence.
sent to ops-warden for the sanctioned registration; net-kingdom does not edit their registry. A systematic pre-production
testing environment (test CA, test principals, test hosts) is Bernd's later topic.
**ops-warden answered 2026-10-02** (`21c85dc3-754e-41fc-a271-02255054e12d`): no production registry change. A rehearsal config
(`WARDEN_CONFIG=~/.config/warden/rehearsal/warden.yaml`, throwaway local CA, no flex-auth gate, no prod trust) signs for the inert
`agt-rehearsal`. The pack now has a `warden_config` datapoint defaulting to it. `nk.ssh-certificates` dry-ran clean (cert: test CA,
principal `rehearsal-inert-nohost` only, 2h). This proves the signing mechanics, not the policy gate; the tunnel stage stays "not proven"
until a test target exists. Dry-runs of packs 1-3 are all clean; Bernd's UI rehearsal is the remaining T05 work. A systematic
pre-production environment (ops-warden's option b) is Bernd's later topic.
## Retire the markdown verifier
```task