coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

NK-WP-0055-T13: kingpath-offsite helper seals break-glass material to Storage Share
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 4515@bnt-lap001
Assistant-Session: 0bf96127-6e04-41be-bfda-d11717c3f354
This commit is contained in:
tegwick 2026-10-27 23:07:22 +01:00
parent e9bc86160f
commit d7fde1f2ba
4 changed files with 309 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

2
workplans/NK-WP-0055-security-platform-production-readiness.md
View file

@ -304,6 +304,8 @@ KeyCape/Authelia down is recorded and drilled by the founder; and use produces a
2026-10-27 documentation pass: the crisis custody list (items 3, 7, 9) and the disaster recovery guide (new section "Reaching the platform when SSO and OpenBao are down") now record what is known. Findings: ops-warden SSH certificates do **not** work with OpenBao down (warden backend is OpenBao); the working path today is the static-key tunnel `k3s-api-railiance01` as `tegwick` plus the admin kubeconfig client certificate, workstation-only with no second copy; the OpenBao `generate-root` break-glass ceremony is undocumented; provider console access, the ops bundle location (item 8) and offline/mirror status of the password safe are `TO CONFIRM`.
2026-10-27 founder answers: unseal shares and `pi-admin` are in the founder's replicated browser password safe (unseal shares under the `kingpath.credentials` pseudo-URL entry); console and rescue access to railiance01 through the Host Europe provider interface; the ops bundle and the cluster break-glass material (static tunnel key, admin kubeconfig) are to be kept age-encrypted on the Storage Share `Backup` account so they survive workstation loss. Next: a guarded upload helper with readback (founder-run), the `generate-root` ceremony with railiance-platform, and the king-path drill. Still open: whether the initial OpenBao root token was kept or revoked.
2026-10-27: the founder holds the initial OpenBao root token offline; whether it is still valid is unconfirmed (no rotation was recorded). Built `tools/bootstrap-recovery/kingpath-offsite.py` with 11 contained tests: it seals named private files in memory to the `railiance-backup` recipient, uploads to `Backup/railiance-backups/net-kingdom-kingpath/` without overwriting, and reads back with a hash check. Founder-run. No ops bundle exists on the workstation (`make creds-bundle` packs only greenfield `creds-generate` output); the daily identity backup already carries current service secrets, so item 8 is proposed for retirement as superseded.
## Policy import pipeline and platform/tenant package split
```task