{ "schema": "netkingdom.identity-backup-profile.v1", "status": "implemented_pending_owner_admission", "owner": "net-kingdom with railiance-platform/rapp-postgres runtime and storage admission", "public_recipient": "age1zvryunvjhvpkmasskauga2heeg0ztnte9ymgppvjge36ekumk50syr3tsz", "archive_profile": "netkingdom-identity-v1; new profile, not the bootstrap secrets-only tar profile", "components": [ { "namespace": "sso", "deployment": "lldap", "deployment_uid": "743a86bd-5cb0-4ca0-9c56-a3438f4746a8", "pvc_refs": [ { "name": "lldap-data", "uid": "0a06b65a-e7b3-42d3-916e-e74dbe5fc7da" } ], "secret_refs": [ "lldap-secrets" ], "configmap_refs": [], "required_assets": [ "SQLite online-backup snapshot of /data/users.db with integrity check", "remaining non-backup durable /data files, including any private identity material", "current deployment configuration and exact lldap-secrets fields" ], "native_acceptance": [ "directory user/group/membership preservation", "existing-user password authentication in isolated environment" ] }, { "namespace": "sso", "deployment": "authelia", "deployment_uid": "dc40a925-2306-4a3b-89c0-e714187503c3", "pvc_refs": [ { "name": "authelia-data", "uid": "86826554-b014-4df4-8b28-866aa64f6413" } ], "secret_refs": [ "authelia-secrets", "authelia-smtp" ], "configmap_refs": [ "authelia-config" ], "required_assets": [ "SQLite online-backup snapshot of /var/authelia/data/db.sqlite3 with integrity check", "current configuration.yml and all Secret-mounted encryption/OIDC/session fields", "explicit disposition for notifier credentials and remaining durable files" ], "native_acceptance": [ "storage decryption", "same OIDC signing identity and preserved client configuration", "isolated authentication flow with outbound notification disabled" ] }, { "namespace": "sso", "deployment": "keycape", "deployment_uid": "99ddd83c-cb3f-4847-bcf8-35f1aa87627f", "pvc_refs": [ { "name": "keycape-authentication-policy", "uid": "423f558f-8c11-4edf-956b-243559df4a8e" } ], "secret_refs": [ "keycape-approval-engine-operator-client", "keycape-config", "keycape-factor-read", "keycape-informed-decision-sitting-requester-client", "keycape-rapp-qonto-client", "keycape-secrets-engine-approval-client", "keycape-secrets-engine-openbao-client", "keycape-secrets-engine-requester-client" ], "configmap_refs": [], "required_assets": [ "exact current keycape-config config.yaml and key.pem", "complete stable policy/receipt PVC snapshot", "current deployment and owner disposition for every referenced credential: encrypted recovery or independently recoverable provider reissue path" ], "native_acceptance": [ "same issuer/JWKS signing identity", "registry, authentication policy and receipt continuity", "current consumer positive/negative authentication under isolated test endpoints" ] }, { "namespace": "mfa", "deployment": "privacyidea", "deployment_uid": "58c7f96d-61cb-4dd4-bca2-54661c0ac375", "pvc_refs": [ { "name": "privacyidea-data", "uid": "65650fc1-02d8-4c0f-84fc-e0015c8f3ed9" }, { "name": "privacyidea-logs", "uid": "39fa90d9-bc54-4a03-a0d6-ae85165e0cb9" } ], "secret_refs": [ "privacyidea-config" ], "configmap_refs": [ "factor-recovery-01119187d90d7b76", "keycape-onboarding-9465e5e0b98f7986", "privacyidea-cfg" ], "required_assets": [ "original /etc/privacyidea/enckey, private.pem and public.pem with matching RSA pair validation", "current privacyidea-config and mounted configuration/scripts", "bounded native PostgreSQL custom dump with exact database identity and key-generation linkage", "explicit disposition for service logs; audit database/signatures must be preserved" ], "native_acceptance": [ "decrypt existing retained token material without exporting it", "verify pre-backup audit signatures and create/verify a new isolated audit entry", "existing-token MFA and negative-key refusal" ] } ], "capture_contract": { "plaintext": "private task staging outside Git; never process output, State Hub or logs; verified cleanup after encryption", "consistency": "native SQLite online-backup and PostgreSQL logical snapshot; explicit capture interval per asset; no global atomic snapshot claim; before/after source identities/config versions and directory inventories must match", "key_policy": "preserve original service keys; no age private key in the payload, no replacement generation, no root/unseal collection", "encryption": "public-recipient-only streaming archive to age; private fresh ciphertext, no overwrite; manifest inside ciphertext with source identities, times, complete required paths, digests and omissions", "limits": "measure first; proposed 512 MiB encrypted admission ceiling, no silent truncation/exclusions", "historical_database": "existing verified October15 dump remains protected; new bundle must link its own exact database/key capture generation and recovery receipt" }, "proposed_destinations": { "initial": "Storage Share Backup/railiance-backups/net-kingdom-identity/", "future_secondary": "s3://railiance-platform-pg-backup/platform-pg/application-archives/net-kingdom/; not implemented/admitted in this rollout", "admitted": false, "publisher": "CCR-2026-0048: new folder-only read/create public DAV share, delivered by exact ESO reader; no operator password in runtime; explicitly owner-approved provider-added re-sharing (permissions21)", "retention": "CCR-2026-0049: separate folder-only read/delete share and process; newest plus seven daily/two weekly and independently recovered pinned generation; unknown/unindexed points never deleted; explicitly owner-approved provider-added re-sharing (permissions25)", "schedule": "source prepared: daily 03:45 UTC plus up to five minutes jitter, hourly 25-hour freshness check; installation leaves timers disabled until independent archive recovery", "quota": "512 MiB ceiling, two GiB fresh provider headroom; initial 10 GiB account quota checked; unsupported public-share quota fails closed" }, "admission_gates": [ "Approve exact CCR-2026-0048/0049 grants and node runtime packet; three required owner reviews, confirmed native SA/namespace/audience boundaries before acceptance", "Exclude helper capture label from existing broad DNS allow policies; validate read-only helper manifests and cluster/PVC/source bindings before private capture", "Preserve every referenced credential encrypted with original keys; fresh native SQLite/PG snapshots and exact manifest, with documented omissions and no global atomicity claim", "Create fresh ciphertext and exact Storage Share object, read back ciphertext and receipt by strong ETag/hash, independently retrieve using operator custody", "Attended independent age-key proof: wrong-key denial, complete archive hashes, SQLite/RSA checks, disposable native PostgreSQL restore and verified cleanup before timer activation", "Full NK49 closure separately requires native directory/issuer/MFA authentication, retained token decryption, audit signature continuity, current callers and legacy credential dispositions; archive acceptance does not close those gates", "Host-local health cannot report a dead host; external outage monitoring and second-provider copy remain separate coverage gaps" ], "runtime_host": { "ssh_alias": "railiance01", "hostname": "239.62.205.92.host.secureserver.net", "machine_id_sha256": "fe7367a60951922122af7ba18ed2cde65c7e0a232bbedfb045cb575de2094c2f" } }