coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

NK-WP-0055-T13: founder custody answers recorded in the crisis list and DR guide
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 4515@bnt-lap001
Assistant-Session: 0bf96127-6e04-41be-bfda-d11717c3f354
This commit is contained in:
tegwick 2026-10-27 23:00:04 +01:00
parent f2956334bf
commit e9bc86160f
3 changed files with 12 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

8
docs/crisis-custody-list.md
View file

@ -31,13 +31,13 @@ circular dependency and is recorded as a gap, not as custody.
| --- | --- | --- | --- | --- | --- | --- |
| 1 | Custodian/backup age private key (recipient `age1zvry…50syr3tsz`, labelled `railiance-backup`) | Decrypts the identity backup bundle and the SOPS custody files | Founder, independently held password safe or offline packet (Standard §4) | Yes, offline | Entered by the founder at hidden prompts 2026-10-24 (LLDAP, Authelia, privacyIDEA stages) | `TO CONFIRM`: number of copies, who else could recover if the founder cannot |
| 2 | Storage Share `Backup` account app password | Downloads the protected ciphertext without OpenBao or SSO | Founder, independent custody `TO CONFIRM` | Yes, provider is outside the platform | Fresh retrieval 2026-10-24 | One provider copy only; residual risk accepted until 2027-01-31 (G1, NK-WP-0053) |
| 3 | OpenBao unseal shares (2 of 3 required in the restore drill) | Unseals a restored or production OpenBao; with the shares, `generate-root` can mint a root token for break-glass (ceremony not yet documented) | Founder as `platform-root` holds all three shares (single-holder custody: accepted exception, hub decision `37464824`, 2026-10-27) | Yes, offline | Original shares used in the isolated restore RPF-WP-0064-T07, 2026-10-24 | `TO CONFIRM` where the shares are kept and that the place opens with SSO down; single holder = single point of loss (reviewed at NK-WP-0055-T09) |
| 3 | OpenBao unseal shares (2 of 3 required in the restore drill) | Unseals a restored or production OpenBao; with the shares, `generate-root` can mint a root token for break-glass (ceremony not yet documented) | Founder as `platform-root` holds all three shares (single-holder custody: accepted exception, hub decision `37464824`, 2026-10-27), in the founder's replicated browser password safe under the `kingpath.credentials` pseudo-URL entry (confirmed 2026-10-27) | Yes: the safe is independent of NetKingdom SSO and OpenBao; it depends on the browser vendor's sync account and its own factor | Original shares used in the isolated restore RPF-WP-0064-T07, 2026-10-24 | Single holder = single point of loss (reviewed at NK-WP-0055-T09). `TO CONFIRM`: whether the initial root token was kept offline or revoked |
| 4 | `platform-root` / king account and factors | Final authority; break-glass | Independently held password safe or offline packet (Standard §4; custody doc) | **No if used through KeyCape**: its login and OTP are validated by the services being recovered | OTP validated against restored privacyIDEA 2026-10-24 (isolated) | `TO CONFIRM` the offline path that works with SSO down (OpenBao shares, item 3) and record it |
| 5 | Founder admission signing key (SSH, principal `bernd`) | Signs attempt and restore admissions | Founder, workstation key; verifier anchor `/etc/secrets-engine/admission/allowed_signers` | Yes | Signed the T40 admission 2026-10-23 | `TO CONFIRM` which identity this key belongs to; the anchor is workstation-bound, so a backup of key and anchor is needed |
| 6 | `admin` password and OTP token | Day-to-day platform administration and, per intent, recovery operation | Founder; OTP enrolled 2026-10-24 | **No**: login and token checks need KeyCape, LLDAP and privacyIDEA | Token not yet in any restored backup; first restore proof after the 2026-10-25 03:45 UTC capture | Same account as the directory bind used by Authelia and privacyIDEA until the split in NK-WP-0054-T05 |
| 7 | `pi-admin` credentials (privacyIDEA internal admin) | Token repair and re-enrolment | Founder's personal password safe (confirmed 2026-10-27) | Custody yes if the safe opens offline; use needs a running privacyIDEA | Not yet drilled | `TO CONFIRM` the safe opens offline and has a second copy; add a pi-admin check to the drill (NK-WP-0053-T04) |
| 8 | Ops bundle (age-encrypted tar of service secrets, `make creds-bundle`) | Point-in-time service secrets | Offsite location `TO CONFIRM` (Standard §7) | Yes, needs item 1 | Not drilled | Confirm location and age; decide whether it duplicates the identity bundle |
| 9 | Operator access to the production host or cluster for a real restore | Applying a restore to production | Today (observed 2026-10-27): ops-bridge tunnel `k3s-api-railiance01` (SSH as `tegwick` to `92.205.62.239` with a **static key file**, local port 16444) plus the attended admin kubeconfig `~/.kube/config-railiance01` (route `kubernetes-railiance01-admin`, client-certificate user). Both live only on the founder workstation | Yes for this path: neither the static SSH key nor the kubeconfig client certificate needs KeyCape or OpenBao. **No** for ops-warden SSH certificates: warden's production backend is OpenBao (`backend: vault`) | Used 2026-10-27 (founder deleted two historical Secrets) | Gaps: workstation-only, no second copy; the path runs as the developer identity `tegwick` under an agent-labelled tunnel actor; provider console/rescue access `TO CONFIRM`. Decide the crisis-operator path (NK-WP-0055-T13) |
| 7 | `pi-admin` credentials (privacyIDEA internal admin) | Token repair and re-enrolment | Founder's replicated browser password safe (confirmed 2026-10-27) | Custody yes (replicated, independent of SSO); use needs a running privacyIDEA | Not yet drilled | Add a pi-admin check to the drill (NK-WP-0053-T04) |
| 8 | Ops bundle (age-encrypted tar of service secrets, `make creds-bundle`) | Point-in-time service secrets | Founder decision 2026-10-27: keep it on the Storage Share (Nextcloud) `Backup` account, beside the identity backup; current location `TO CONFIRM` until uploaded | Yes, needs items 1 and 2 | Not drilled | Upload with readback (NK-WP-0055-T13); decide whether it duplicates the identity bundle |
| 9 | Operator access to the production host or cluster for a real restore | Applying a restore to production | Cluster: ops-bridge tunnel `k3s-api-railiance01` (SSH as `tegwick` to `92.205.62.239` with a static key file, local port 16444) plus the attended admin kubeconfig `~/.kube/config-railiance01` (client certificate), today on the founder workstation only. Host: Host Europe provider interface with console and rescue access to railiance01 (confirmed 2026-10-27) | Yes: static key, client certificate and provider console need neither KeyCape nor OpenBao. **No** for ops-warden SSH certificates (warden's backend is OpenBao) | Cluster path used 2026-10-27 | Founder decision 2026-10-27: an age-encrypted copy of the cluster break-glass material goes to the Storage Share `Backup` account so it survives workstation loss (NK-WP-0055-T13). Open: runs as `tegwick` under an agent-labelled actor; provider console never drilled |
## Non-secret recovery assets

8
docs/disaster-recovery-storage-share.md
View file

@ -131,13 +131,17 @@ are signed by OpenBao. With those down, only paths built on offline material wor
- **Cluster:** the attended admin kubeconfig (`~/.kube/config-railiance01`,
client certificate) through the `k3s-api-railiance01` tunnel, which uses a
static SSH key. Both are on the founder workstation only.
static SSH key. Today both are on the founder workstation only.
- **OpenBao:** unseal with the shares (crisis list item 3). If an admin token is
needed while OIDC is down, the shares can mint a short-lived root token with
`generate-root`. **That ceremony is not documented yet**:
`railiance-platform/docs/openbao.md` covers only the initial root token.
Writing it down and drilling it is NK-WP-0055-T13.
- **Host:** `TO CONFIRM` provider console or rescue access.
- **Host:** console and rescue access through the Host Europe provider
interface, which is independent of the platform.
- **Workstation lost:** an age-encrypted copy of the cluster break-glass
material and the ops bundle is to be kept on the Storage Share `Backup`
account (planned, NK-WP-0055-T13); decrypting it needs only crisis list items 1 and 2.
Every use is a break-glass event: record what was done and why for review.
Item-level custody and open gaps are in the crisis custody list; drilling this

2
workplans/NK-WP-0055-security-platform-production-readiness.md
View file

@ -302,6 +302,8 @@ KeyCape/Authelia down is recorded and drilled by the founder; and use produces a
2026-10-27 documentation pass: the crisis custody list (items 3, 7, 9) and the disaster recovery guide (new section "Reaching the platform when SSO and OpenBao are down") now record what is known. Findings: ops-warden SSH certificates do **not** work with OpenBao down (warden backend is OpenBao); the working path today is the static-key tunnel `k3s-api-railiance01` as `tegwick` plus the admin kubeconfig client certificate, workstation-only with no second copy; the OpenBao `generate-root` break-glass ceremony is undocumented; provider console access, the ops bundle location (item 8) and offline/mirror status of the password safe are `TO CONFIRM`.
2026-10-27 founder answers: unseal shares and `pi-admin` are in the founder's replicated browser password safe (unseal shares under the `kingpath.credentials` pseudo-URL entry); console and rescue access to railiance01 through the Host Europe provider interface; the ops bundle and the cluster break-glass material (static tunnel key, admin kubeconfig) are to be kept age-encrypted on the Storage Share `Backup` account so they survive workstation loss. Next: a guarded upload helper with readback (founder-run), the `generate-root` ceremony with railiance-platform, and the king-path drill. Still open: whether the initial OpenBao root token was kept or revoked.
## Policy import pipeline and platform/tenant package split
```task