From e9bc86160fe2b82bb54a05bbf6794c1c961744a3 Mon Sep 17 00:00:00 2001 From: tegwick Date: Tue, 27 Oct 2026 23:00:04 +0100 Subject: [PATCH] NK-WP-0055-T13: founder custody answers recorded in the crisis list and DR guide Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 4515@bnt-lap001 Assistant-Session: 0bf96127-6e04-41be-bfda-d11717c3f354 --- docs/crisis-custody-list.md | 8 ++++---- docs/disaster-recovery-storage-share.md | 8 ++++++-- .../NK-WP-0055-security-platform-production-readiness.md | 2 ++ 3 files changed, 12 insertions(+), 6 deletions(-) diff --git a/docs/crisis-custody-list.md b/docs/crisis-custody-list.md index d21542a..a4127dc 100644 --- a/docs/crisis-custody-list.md +++ b/docs/crisis-custody-list.md @@ -31,13 +31,13 @@ circular dependency and is recorded as a gap, not as custody. | --- | --- | --- | --- | --- | --- | --- | | 1 | Custodian/backup age private key (recipient `age1zvry…50syr3tsz`, labelled `railiance-backup`) | Decrypts the identity backup bundle and the SOPS custody files | Founder, independently held password safe or offline packet (Standard §4) | Yes, offline | Entered by the founder at hidden prompts 2026-10-24 (LLDAP, Authelia, privacyIDEA stages) | `TO CONFIRM`: number of copies, who else could recover if the founder cannot | | 2 | Storage Share `Backup` account app password | Downloads the protected ciphertext without OpenBao or SSO | Founder, independent custody `TO CONFIRM` | Yes, provider is outside the platform | Fresh retrieval 2026-10-24 | One provider copy only; residual risk accepted until 2027-01-31 (G1, NK-WP-0053) | -| 3 | OpenBao unseal shares (2 of 3 required in the restore drill) | Unseals a restored or production OpenBao; with the shares, `generate-root` can mint a root token for break-glass (ceremony not yet documented) | Founder as `platform-root` holds all three shares (single-holder custody: accepted exception, hub decision `37464824`, 2026-10-27) | Yes, offline | Original shares used in the isolated restore RPF-WP-0064-T07, 2026-10-24 | `TO CONFIRM` where the shares are kept and that the place opens with SSO down; single holder = single point of loss (reviewed at NK-WP-0055-T09) | +| 3 | OpenBao unseal shares (2 of 3 required in the restore drill) | Unseals a restored or production OpenBao; with the shares, `generate-root` can mint a root token for break-glass (ceremony not yet documented) | Founder as `platform-root` holds all three shares (single-holder custody: accepted exception, hub decision `37464824`, 2026-10-27), in the founder's replicated browser password safe under the `kingpath.credentials` pseudo-URL entry (confirmed 2026-10-27) | Yes: the safe is independent of NetKingdom SSO and OpenBao; it depends on the browser vendor's sync account and its own factor | Original shares used in the isolated restore RPF-WP-0064-T07, 2026-10-24 | Single holder = single point of loss (reviewed at NK-WP-0055-T09). `TO CONFIRM`: whether the initial root token was kept offline or revoked | | 4 | `platform-root` / king account and factors | Final authority; break-glass | Independently held password safe or offline packet (Standard §4; custody doc) | **No if used through KeyCape**: its login and OTP are validated by the services being recovered | OTP validated against restored privacyIDEA 2026-10-24 (isolated) | `TO CONFIRM` the offline path that works with SSO down (OpenBao shares, item 3) and record it | | 5 | Founder admission signing key (SSH, principal `bernd`) | Signs attempt and restore admissions | Founder, workstation key; verifier anchor `/etc/secrets-engine/admission/allowed_signers` | Yes | Signed the T40 admission 2026-10-23 | `TO CONFIRM` which identity this key belongs to; the anchor is workstation-bound, so a backup of key and anchor is needed | | 6 | `admin` password and OTP token | Day-to-day platform administration and, per intent, recovery operation | Founder; OTP enrolled 2026-10-24 | **No**: login and token checks need KeyCape, LLDAP and privacyIDEA | Token not yet in any restored backup; first restore proof after the 2026-10-25 03:45 UTC capture | Same account as the directory bind used by Authelia and privacyIDEA until the split in NK-WP-0054-T05 | -| 7 | `pi-admin` credentials (privacyIDEA internal admin) | Token repair and re-enrolment | Founder's personal password safe (confirmed 2026-10-27) | Custody yes if the safe opens offline; use needs a running privacyIDEA | Not yet drilled | `TO CONFIRM` the safe opens offline and has a second copy; add a pi-admin check to the drill (NK-WP-0053-T04) | -| 8 | Ops bundle (age-encrypted tar of service secrets, `make creds-bundle`) | Point-in-time service secrets | Offsite location `TO CONFIRM` (Standard §7) | Yes, needs item 1 | Not drilled | Confirm location and age; decide whether it duplicates the identity bundle | -| 9 | Operator access to the production host or cluster for a real restore | Applying a restore to production | Today (observed 2026-10-27): ops-bridge tunnel `k3s-api-railiance01` (SSH as `tegwick` to `92.205.62.239` with a **static key file**, local port 16444) plus the attended admin kubeconfig `~/.kube/config-railiance01` (route `kubernetes-railiance01-admin`, client-certificate user). Both live only on the founder workstation | Yes for this path: neither the static SSH key nor the kubeconfig client certificate needs KeyCape or OpenBao. **No** for ops-warden SSH certificates: warden's production backend is OpenBao (`backend: vault`) | Used 2026-10-27 (founder deleted two historical Secrets) | Gaps: workstation-only, no second copy; the path runs as the developer identity `tegwick` under an agent-labelled tunnel actor; provider console/rescue access `TO CONFIRM`. Decide the crisis-operator path (NK-WP-0055-T13) | +| 7 | `pi-admin` credentials (privacyIDEA internal admin) | Token repair and re-enrolment | Founder's replicated browser password safe (confirmed 2026-10-27) | Custody yes (replicated, independent of SSO); use needs a running privacyIDEA | Not yet drilled | Add a pi-admin check to the drill (NK-WP-0053-T04) | +| 8 | Ops bundle (age-encrypted tar of service secrets, `make creds-bundle`) | Point-in-time service secrets | Founder decision 2026-10-27: keep it on the Storage Share (Nextcloud) `Backup` account, beside the identity backup; current location `TO CONFIRM` until uploaded | Yes, needs items 1 and 2 | Not drilled | Upload with readback (NK-WP-0055-T13); decide whether it duplicates the identity bundle | +| 9 | Operator access to the production host or cluster for a real restore | Applying a restore to production | Cluster: ops-bridge tunnel `k3s-api-railiance01` (SSH as `tegwick` to `92.205.62.239` with a static key file, local port 16444) plus the attended admin kubeconfig `~/.kube/config-railiance01` (client certificate), today on the founder workstation only. Host: Host Europe provider interface with console and rescue access to railiance01 (confirmed 2026-10-27) | Yes: static key, client certificate and provider console need neither KeyCape nor OpenBao. **No** for ops-warden SSH certificates (warden's backend is OpenBao) | Cluster path used 2026-10-27 | Founder decision 2026-10-27: an age-encrypted copy of the cluster break-glass material goes to the Storage Share `Backup` account so it survives workstation loss (NK-WP-0055-T13). Open: runs as `tegwick` under an agent-labelled actor; provider console never drilled | ## Non-secret recovery assets diff --git a/docs/disaster-recovery-storage-share.md b/docs/disaster-recovery-storage-share.md index 2f1cb20..7a1acd0 100644 --- a/docs/disaster-recovery-storage-share.md +++ b/docs/disaster-recovery-storage-share.md @@ -131,13 +131,17 @@ are signed by OpenBao. With those down, only paths built on offline material wor - **Cluster:** the attended admin kubeconfig (`~/.kube/config-railiance01`, client certificate) through the `k3s-api-railiance01` tunnel, which uses a - static SSH key. Both are on the founder workstation only. + static SSH key. Today both are on the founder workstation only. - **OpenBao:** unseal with the shares (crisis list item 3). If an admin token is needed while OIDC is down, the shares can mint a short-lived root token with `generate-root`. **That ceremony is not documented yet**: `railiance-platform/docs/openbao.md` covers only the initial root token. Writing it down and drilling it is NK-WP-0055-T13. -- **Host:** `TO CONFIRM` provider console or rescue access. +- **Host:** console and rescue access through the Host Europe provider + interface, which is independent of the platform. +- **Workstation lost:** an age-encrypted copy of the cluster break-glass + material and the ops bundle is to be kept on the Storage Share `Backup` + account (planned, NK-WP-0055-T13); decrypting it needs only crisis list items 1 and 2. Every use is a break-glass event: record what was done and why for review. Item-level custody and open gaps are in the crisis custody list; drilling this diff --git a/workplans/NK-WP-0055-security-platform-production-readiness.md b/workplans/NK-WP-0055-security-platform-production-readiness.md index 217ee70..b6a0243 100644 --- a/workplans/NK-WP-0055-security-platform-production-readiness.md +++ b/workplans/NK-WP-0055-security-platform-production-readiness.md @@ -302,6 +302,8 @@ KeyCape/Authelia down is recorded and drilled by the founder; and use produces a 2026-10-27 documentation pass: the crisis custody list (items 3, 7, 9) and the disaster recovery guide (new section "Reaching the platform when SSO and OpenBao are down") now record what is known. Findings: ops-warden SSH certificates do **not** work with OpenBao down (warden backend is OpenBao); the working path today is the static-key tunnel `k3s-api-railiance01` as `tegwick` plus the admin kubeconfig client certificate, workstation-only with no second copy; the OpenBao `generate-root` break-glass ceremony is undocumented; provider console access, the ops bundle location (item 8) and offline/mirror status of the password safe are `TO CONFIRM`. + +2026-10-27 founder answers: unseal shares and `pi-admin` are in the founder's replicated browser password safe (unseal shares under the `kingpath.credentials` pseudo-URL entry); console and rescue access to railiance01 through the Host Europe provider interface; the ops bundle and the cluster break-glass material (static tunnel key, admin kubeconfig) are to be kept age-encrypted on the Storage Share `Backup` account so they survive workstation loss. Next: a guarded upload helper with readback (founder-run), the `generate-root` ceremony with railiance-platform, and the king-path drill. Still open: whether the initial OpenBao root token was kept or revoked. ## Policy import pipeline and platform/tenant package split ```task