diff --git a/canon/standards/audit-correlation_v0.1.md b/canon/standards/audit-correlation_v0.1.md index 5159ad1..a2bbf43 100644 --- a/canon/standards/audit-correlation_v0.1.md +++ b/canon/standards/audit-correlation_v0.1.md @@ -2,13 +2,13 @@ id: NK-STD-AUDIT-CORRELATION title: "Audit Correlation Contract" version: "0.1" -status: proposed +status: accepted owner: net-kingdom created: "2026-10-27" work: NK-WP-0055-T11 --- -# Audit Correlation Contract v0.1 (proposed) +# Audit Correlation Contract v0.1 ## Purpose diff --git a/docs/crisis-custody-list.md b/docs/crisis-custody-list.md index 160f2f0..d21542a 100644 --- a/docs/crisis-custody-list.md +++ b/docs/crisis-custody-list.md @@ -31,13 +31,13 @@ circular dependency and is recorded as a gap, not as custody. | --- | --- | --- | --- | --- | --- | --- | | 1 | Custodian/backup age private key (recipient `age1zvry…50syr3tsz`, labelled `railiance-backup`) | Decrypts the identity backup bundle and the SOPS custody files | Founder, independently held password safe or offline packet (Standard §4) | Yes, offline | Entered by the founder at hidden prompts 2026-10-24 (LLDAP, Authelia, privacyIDEA stages) | `TO CONFIRM`: number of copies, who else could recover if the founder cannot | | 2 | Storage Share `Backup` account app password | Downloads the protected ciphertext without OpenBao or SSO | Founder, independent custody `TO CONFIRM` | Yes, provider is outside the platform | Fresh retrieval 2026-10-24 | One provider copy only; residual risk accepted until 2027-01-31 (G1, NK-WP-0053) | -| 3 | OpenBao unseal shares (2 of 3 required in the restore drill) | Unseals a restored or production OpenBao | Holders `TO CONFIRM` (custody doc: escrow holders "to be named") | Yes, offline | Original shares used in the isolated restore RPF-WP-0064-T07, 2026-10-24 | Name the three holders and where each share is kept; confirm none depends on SSO | +| 3 | OpenBao unseal shares (2 of 3 required in the restore drill) | Unseals a restored or production OpenBao; with the shares, `generate-root` can mint a root token for break-glass (ceremony not yet documented) | Founder as `platform-root` holds all three shares (single-holder custody: accepted exception, hub decision `37464824`, 2026-10-27) | Yes, offline | Original shares used in the isolated restore RPF-WP-0064-T07, 2026-10-24 | `TO CONFIRM` where the shares are kept and that the place opens with SSO down; single holder = single point of loss (reviewed at NK-WP-0055-T09) | | 4 | `platform-root` / king account and factors | Final authority; break-glass | Independently held password safe or offline packet (Standard §4; custody doc) | **No if used through KeyCape**: its login and OTP are validated by the services being recovered | OTP validated against restored privacyIDEA 2026-10-24 (isolated) | `TO CONFIRM` the offline path that works with SSO down (OpenBao shares, item 3) and record it | | 5 | Founder admission signing key (SSH, principal `bernd`) | Signs attempt and restore admissions | Founder, workstation key; verifier anchor `/etc/secrets-engine/admission/allowed_signers` | Yes | Signed the T40 admission 2026-10-23 | `TO CONFIRM` which identity this key belongs to; the anchor is workstation-bound, so a backup of key and anchor is needed | | 6 | `admin` password and OTP token | Day-to-day platform administration and, per intent, recovery operation | Founder; OTP enrolled 2026-10-24 | **No**: login and token checks need KeyCape, LLDAP and privacyIDEA | Token not yet in any restored backup; first restore proof after the 2026-10-25 03:45 UTC capture | Same account as the directory bind used by Authelia and privacyIDEA until the split in NK-WP-0054-T05 | -| 7 | `pi-admin` credentials (privacyIDEA internal admin) | Token repair and re-enrolment | Founder's personal password safe (stated 2026-10-24) | Custody yes if the safe opens offline; use needs a running privacyIDEA | Not yet drilled | Confirm the safe is reachable offline and mirrored; add a pi-admin check to the drill | +| 7 | `pi-admin` credentials (privacyIDEA internal admin) | Token repair and re-enrolment | Founder's personal password safe (confirmed 2026-10-27) | Custody yes if the safe opens offline; use needs a running privacyIDEA | Not yet drilled | `TO CONFIRM` the safe opens offline and has a second copy; add a pi-admin check to the drill (NK-WP-0053-T04) | | 8 | Ops bundle (age-encrypted tar of service secrets, `make creds-bundle`) | Point-in-time service secrets | Offsite location `TO CONFIRM` (Standard §7) | Yes, needs item 1 | Not drilled | Confirm location and age; decide whether it duplicates the identity bundle | -| 9 | Operator access to the production host or cluster for a real restore (SSH certificate or kubeconfig) | Applying a restore to production | `TO CONFIRM` | `TO CONFIRM`: ops-warden issues SSH certificates; whether that works with SSO down is unknown | Not drilled | Establish the crisis path and record it | +| 9 | Operator access to the production host or cluster for a real restore | Applying a restore to production | Today (observed 2026-10-27): ops-bridge tunnel `k3s-api-railiance01` (SSH as `tegwick` to `92.205.62.239` with a **static key file**, local port 16444) plus the attended admin kubeconfig `~/.kube/config-railiance01` (route `kubernetes-railiance01-admin`, client-certificate user). Both live only on the founder workstation | Yes for this path: neither the static SSH key nor the kubeconfig client certificate needs KeyCape or OpenBao. **No** for ops-warden SSH certificates: warden's production backend is OpenBao (`backend: vault`) | Used 2026-10-27 (founder deleted two historical Secrets) | Gaps: workstation-only, no second copy; the path runs as the developer identity `tegwick` under an agent-labelled tunnel actor; provider console/rescue access `TO CONFIRM`. Decide the crisis-operator path (NK-WP-0055-T13) | ## Non-secret recovery assets diff --git a/docs/disaster-recovery-storage-share.md b/docs/disaster-recovery-storage-share.md index 198b8f6..2f1cb20 100644 --- a/docs/disaster-recovery-storage-share.md +++ b/docs/disaster-recovery-storage-share.md @@ -1,6 +1,6 @@ # NetKingdom disaster recovery — start here -Updated 2026-10-16. Owner: NetKingdom with Railiance Platform and the individual +Updated 2026-10-27. Owner: NetKingdom with Railiance Platform and the individual identity service owners. This guide covers the identity backup, not whole-host, OpenBao, Forgejo, User Engine or application recovery. @@ -101,10 +101,13 @@ ordinary persistent recovery media. The age private key is never in the bundle. ## Restoring working services -**Archive recovery passed on 2026-10-16. Full restored-service acceptance remains -open.** The archive verifier deletes its plaintext and is not a service importer. -Follow `docs/identity-service-restore-packet.md` with service owners before an -isolated service drill. Its pending target and image fields must be resolved. +**Archive recovery passed on 2026-10-16. Isolated restored-service recovery passed +for LLDAP, Authelia, privacyIDEA (MFA and audit), KeyCape (issuer side) and OpenBao +by 2026-10-24, and was owner-accepted in builder mode on 2026-10-27 (NK-WP-0049).** +A joint restore with a live consumer login is still a pre-production drill +(NK-WP-0055-T02/T03). The archive verifier deletes its plaintext and is not a +service importer. Follow `docs/identity-service-restore-packet.md` and the +[identity restore drill](identity-restore-drill.md) for a service drill. Restore the exact matching data/config/original keys into an isolated recovery environment first. Keep production ingress, public DNS, notifications, external @@ -120,6 +123,26 @@ approve a production cutover, including target identity, rollback, DNS/ingress, current consumers, credential dispositions and monitoring. This guide does not authorize a production restore or automatic credential rotation. +## Reaching the platform when SSO and OpenBao are down + +The normal admin paths need the services being recovered: KeyCape OIDC with +privacyIDEA MFA for OpenBao and portals, and ops-warden SSH certificates, which +are signed by OpenBao. With those down, only paths built on offline material work: + +- **Cluster:** the attended admin kubeconfig (`~/.kube/config-railiance01`, + client certificate) through the `k3s-api-railiance01` tunnel, which uses a + static SSH key. Both are on the founder workstation only. +- **OpenBao:** unseal with the shares (crisis list item 3). If an admin token is + needed while OIDC is down, the shares can mint a short-lived root token with + `generate-root`. **That ceremony is not documented yet**: + `railiance-platform/docs/openbao.md` covers only the initial root token. + Writing it down and drilling it is NK-WP-0055-T13. +- **Host:** `TO CONFIRM` provider console or rescue access. + +Every use is a break-glass event: record what was done and why for review. +Item-level custody and open gaps are in the crisis custody list; drilling this +path is NK-WP-0055-T13. + ## Who and what unlocks recovery The [crisis custody list](crisis-custody-list.md) names every item that unlocks recovery, who holds @@ -137,5 +160,6 @@ Existing Scaleway database backups do not establish a second full identity copy. Host-local health cannot report a dead host. Full service login/MFA/audit proofs, an independently executed outage-path retrieval drill, a second provider copy and external host-loss monitoring must not be assumed from an upload or this -guide. Track remaining acceptance in NK-WP-0049; current task state lives in the -repository and may be newer than this offline guide. +guide. Track remaining drills in NK-WP-0053 and production readiness in +NK-WP-0055; current task state lives in the repository and may be newer than +this offline guide. diff --git a/workplans/NK-WP-0055-security-platform-production-readiness.md b/workplans/NK-WP-0055-security-platform-production-readiness.md index 02a0da2..217ee70 100644 --- a/workplans/NK-WP-0055-security-platform-production-readiness.md +++ b/workplans/NK-WP-0055-security-platform-production-readiness.md @@ -300,6 +300,8 @@ state_hub_task_id: "6dfdf2be-e87a-5368-b2b6-45dcb92fe6e4" **Done when:** the crisis custody list items 4, 7, 8 and 9 are confirmed (kept current by NK-WP-0054-T07); a path that works with KeyCape/Authelia down is recorded and drilled by the founder; and use produces a post-event review record. + +2026-10-27 documentation pass: the crisis custody list (items 3, 7, 9) and the disaster recovery guide (new section "Reaching the platform when SSO and OpenBao are down") now record what is known. Findings: ops-warden SSH certificates do **not** work with OpenBao down (warden backend is OpenBao); the working path today is the static-key tunnel `k3s-api-railiance01` as `tegwick` plus the admin kubeconfig client certificate, workstation-only with no second copy; the OpenBao `generate-root` break-glass ceremony is undocumented; provider console access, the ops bundle location (item 8) and offline/mirror status of the password safe are `TO CONFIRM`. ## Policy import pipeline and platform/tenant package split ```task