coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
1108 commits 2 branches 0 tags 5.6 MiB
Commit graph

19 commits

Author SHA1 Message Date
tegwick
ad7d1cdf49 NK-WP-0056-T04 done: svc-privacyidea written through from OpenBao; all four binds in platform custody
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details 
Founder-run under CCR-2026-0055: setup, verify and realm_bootstrap.py
--rotate-bind --from-openbao with the admin MFA proof. The first apply's check
got a code that was not admin's, so both MFA prompts now name the user.
Custody re-sealed after setup.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 896183@bnt-lap001
Assistant-Session: 3a18c01a-3205-4d02-94db-9efff25649a2
 2026-10-31 11:19:21 +01:00
tegwick
a65673985c NK-WP-0056-T04: svc-keycape bind delivered from OpenBao; bindPW cleared from keycape-config
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details 
Founder-run under CCR-2026-0054: setup, ESO apply, verify, rollout of KeyCape
main-e2b5fa1 with KEYCAPE_LLDAP_BIND_PW, clear-password, restart, env-only verify;
admin signed in with OTP before and after the clear. Custody re-sealed after setup.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 896183@bnt-lap001
Assistant-Session: 3a18c01a-3205-4d02-94db-9efff25649a2
 2026-10-31 10:52:05 +01:00
tegwick
7f37e2521f NK-WP-0056-T04: svc-authelia bind delivered from OpenBao; setup and verify receipts
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details 
Founder-run under CCR-2026-0053: setup (custody equal to live, KV v1 CAS=0),
ESO apply, verify and Authelia restart passed; admin signed in with OTP.
Custody copy re-sealed after setup (same recipient, contents unchanged).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 896183@bnt-lap001
Assistant-Session: 3a18c01a-3205-4d02-94db-9efff25649a2
 2026-10-31 10:11:07 +01:00
tegwick
985cfc37de NK-WP-0056-T04: bind ESO sets explicit target metadata so the last-applied annotation is not copied 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 673304@bnt-lap001
Assistant-Session: 959b12c7-cf2e-440b-a60d-91229cc9e96e
 2026-10-30 23:16:21 +01:00
tegwick
5a52dc8a23 NK-WP-0056-T04: custody client secret reconciled with live; re-sealed custody 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 673304@bnt-lap001
Assistant-Session: 959b12c7-cf2e-440b-a60d-91229cc9e96e
 2026-10-30 22:01:30 +01:00
tegwick
14e7056469 NK-WP-0054-T05: evidence — resolver password restored from custody; OpenBao login works 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 673304@bnt-lap001
Assistant-Session: 959b12c7-cf2e-440b-a60d-91229cc9e96e
 2026-10-30 21:49:34 +01:00
tegwick
103c2c1505 NK-WP-0054-T05: re-seal custody after the bind split (ld-admin and svc-* binds)
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details 
Encrypted to keys/age.pub; plaintext shredded by the founder after step 10.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 620478@bnt-lap001
Assistant-Session: 944e8353-7102-4bc8-affe-84586a10f2d0
 2026-10-30 20:02:36 +01:00
Bernd Worsch
329f086743 chore(creds): encrypted secrets [agent NK-WP-0005] 2026-03-21 12:09:53 +00:00
Bernd Worsch
aa0edabb81 chore(creds): encrypted secrets [agent NK-WP-0005] 2026-03-21 11:43:02 +00:00
Bernd Worsch
49ded70e4b chore(creds): encrypted secrets [agent NK-WP-0005] 2026-03-21 11:37:13 +00:00
Bernd Worsch
eb7c21a00c chore(creds): encrypted secrets [agent NK-WP-0005] 2026-03-21 11:34:50 +00:00
Bernd Worsch
152c2aac72 chore(creds): encrypted secrets [agent NK-WP-0005] 2026-03-21 11:24:38 +00:00
Bernd Worsch
daeeb863cb chore(creds): encrypted secrets [agent NK-WP-0005] 2026-03-21 11:22:53 +00:00
Bernd Worsch
ca853a84b7 chore(creds): encrypted secrets [agent NK-WP-0005] 2026-03-21 10:59:13 +00:00
Bernd Worsch
5d032db3dd chore(creds): encrypted secrets [agent NK-WP-0005] 2026-03-21 10:51:47 +00:00
Bernd Worsch
0ea05b302c chore(creds): encrypted secrets [agent NK-WP-0005] 2026-03-21 10:50:22 +00:00
Bernd Worsch
963a4700ef chore(creds): encrypted secrets [agent NK-WP-0005] 2026-03-21 10:44:37 +00:00
Bernd Worsch
33b9b93dba chore(creds): encrypted secrets [agent NK-WP-0005] 2026-03-21 10:42:39 +00:00
Bernd Worsch
6d25d088d7 feat(sso-mfa): T02/T03 live apply — age-encrypted secrets, CNPG cluster (NK-WP-0001-T02/T03) 
- Add encrypt-secrets.sh / decrypt-secrets.sh: age-based secrets workflow
  replaces KeePassXC dependency; encrypted .env.age files committed to repo
- Add bootstrap/secrets.enc/: all component secrets encrypted to age pubkey
- Fix .gitignore: allow secrets.enc/**/*.age while blocking plaintext
- Fix verify-t02.sh: update netpol names for Authelia+LLDAP+KeyCape stack
- Fix verify-t03.sh: remove keycloak_db/role checks; fix ((PASS++)) set-e bug
- Update postgresql/cluster.yaml: drop keycloak_db, bootstrap privacyidea_db only
- Update postgresql/create-secrets.sh: remove keycloak secret
- Fix netpol-databases.yaml: add port 8000 for CNPG instance manager HTTP API
- T02 COMPLETE: namespaces, network policies, cert-manager issuers applied
- T03 COMPLETE: CNPG operator installed, net-kingdom-pg cluster healthy

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-03-20 02:57:41 +00:00