net-kingdom/tools/bootstrap-recovery/identity-backup-profile.json

{
  "schema": "netkingdom.identity-backup-profile.v1",
  "status": "implemented_pending_owner_admission",
  "owner": "net-kingdom with railiance-platform/rapp-postgres runtime and storage admission",
  "public_recipient": "age1zvryunvjhvpkmasskauga2heeg0ztnte9ymgppvjge36ekumk50syr3tsz",
  "archive_profile": "netkingdom-identity-v1; new profile, not the bootstrap secrets-only tar profile",
  "components": [
    {
      "namespace": "sso",
      "deployment": "lldap",
      "deployment_uid": "743a86bd-5cb0-4ca0-9c56-a3438f4746a8",
      "pvc_refs": [
        {
          "name": "lldap-data",
          "uid": "0a06b65a-e7b3-42d3-916e-e74dbe5fc7da"
        }
      ],
      "secret_refs": [
        "lldap-secrets"
      ],
      "configmap_refs": [],
      "required_assets": [
        "SQLite online-backup snapshot of /data/users.db with integrity check",
        "remaining non-backup durable /data files, including any private identity material",
        "current deployment configuration and exact lldap-secrets fields"
      ],
      "native_acceptance": [
        "directory user/group/membership preservation",
        "existing-user password authentication in isolated environment"
      ]
    },
    {
      "namespace": "sso",
      "deployment": "authelia",
      "deployment_uid": "dc40a925-2306-4a3b-89c0-e714187503c3",
      "pvc_refs": [
        {
          "name": "authelia-data",
          "uid": "86826554-b014-4df4-8b28-866aa64f6413"
        }
      ],
      "secret_refs": [
        "authelia-secrets",
        "authelia-smtp"
      ],
      "configmap_refs": [
        "authelia-config"
      ],
      "required_assets": [
        "SQLite online-backup snapshot of /var/authelia/data/db.sqlite3 with integrity check",
        "current configuration.yml and all Secret-mounted encryption/OIDC/session fields",
        "explicit disposition for notifier credentials and remaining durable files"
      ],
      "native_acceptance": [
        "storage decryption",
        "same OIDC signing identity and preserved client configuration",
        "isolated authentication flow with outbound notification disabled"
      ]
    },
    {
      "namespace": "sso",
      "deployment": "keycape",
      "deployment_uid": "99ddd83c-cb3f-4847-bcf8-35f1aa87627f",
      "pvc_refs": [
        {
          "name": "keycape-authentication-policy",
          "uid": "423f558f-8c11-4edf-956b-243559df4a8e"
        }
      ],
      "secret_refs": [
        "keycape-approval-engine-operator-client",
        "keycape-config",
        "keycape-factor-read",
        "keycape-informed-decision-sitting-requester-client",
        "keycape-rapp-qonto-client",
        "keycape-secrets-engine-approval-client",
        "keycape-secrets-engine-openbao-client",
        "keycape-secrets-engine-requester-client"
      ],
      "configmap_refs": [],
      "required_assets": [
        "exact current keycape-config config.yaml and key.pem",
        "complete stable policy/receipt PVC snapshot",
        "current deployment and owner disposition for every referenced credential: encrypted recovery or independently recoverable provider reissue path"
      ],
      "native_acceptance": [
        "same issuer/JWKS signing identity",
        "registry, authentication policy and receipt continuity",
        "current consumer positive/negative authentication under isolated test endpoints"
      ]
    },
    {
      "namespace": "mfa",
      "deployment": "privacyidea",
      "deployment_uid": "58c7f96d-61cb-4dd4-bca2-54661c0ac375",
      "pvc_refs": [
        {
          "name": "privacyidea-data",
          "uid": "65650fc1-02d8-4c0f-84fc-e0015c8f3ed9"
        },
        {
          "name": "privacyidea-logs",
          "uid": "39fa90d9-bc54-4a03-a0d6-ae85165e0cb9"
        }
      ],
      "secret_refs": [
        "privacyidea-config"
      ],
      "configmap_refs": [
        "factor-recovery-01119187d90d7b76",
        "keycape-onboarding-9465e5e0b98f7986",
        "privacyidea-cfg"
      ],
      "required_assets": [
        "original /etc/privacyidea/enckey, private.pem and public.pem with matching RSA pair validation",
        "current privacyidea-config and mounted configuration/scripts",
        "bounded native PostgreSQL custom dump with exact database identity and key-generation linkage",
        "explicit disposition for service logs; audit database/signatures must be preserved"
      ],
      "native_acceptance": [
        "decrypt existing retained token material without exporting it",
        "verify pre-backup audit signatures and create/verify a new isolated audit entry",
        "existing-token MFA and negative-key refusal"
      ]
    }
  ],
  "capture_contract": {
    "plaintext": "private task staging outside Git; never process output, State Hub or logs; verified cleanup after encryption",
    "consistency": "native SQLite online-backup and PostgreSQL logical snapshot; explicit capture interval per asset; no global atomic snapshot claim; before/after source identities/config versions and directory inventories must match",
    "key_policy": "preserve original service keys; no age private key in the payload, no replacement generation, no root/unseal collection",
    "encryption": "public-recipient-only streaming archive to age; private fresh ciphertext, no overwrite; manifest inside ciphertext with source identities, times, complete required paths, digests and omissions",
    "limits": "measure first; proposed 512 MiB encrypted admission ceiling, no silent truncation/exclusions",
    "historical_database": "existing verified October15 dump remains protected; new bundle must link its own exact database/key capture generation and recovery receipt"
  },
  "proposed_destinations": {
    "initial": "Storage Share Backup/railiance-backups/net-kingdom-identity/",
    "future_secondary": "s3://railiance-platform-pg-backup/platform-pg/application-archives/net-kingdom/; not implemented/admitted in this rollout",
    "admitted": false,
    "publisher": "CCR-2026-0048: new folder-only read/create public DAV share, delivered by exact ESO reader; no operator password in runtime; explicitly owner-approved provider-added re-sharing (permissions21)",
    "retention": "CCR-2026-0049: separate folder-only read/delete share and process; newest plus seven daily/two weekly and independently recovered pinned generation; unknown/unindexed points never deleted; explicitly owner-approved provider-added re-sharing (permissions25)",
    "schedule": "source prepared: daily 03:45 UTC plus up to five minutes jitter, hourly 25-hour freshness check; installation leaves timers disabled until independent archive recovery",
    "quota": "512 MiB ceiling, two GiB fresh provider headroom; initial 10 GiB account quota checked; unsupported public-share quota fails closed"
  },
  "admission_gates": [
    "Approve exact CCR-2026-0048/0049 grants and node runtime packet; three required owner reviews, confirmed native SA/namespace/audience boundaries before acceptance",
    "Exclude helper capture label from existing broad DNS allow policies; validate read-only helper manifests and cluster/PVC/source bindings before private capture",
    "Preserve every referenced credential encrypted with original keys; fresh native SQLite/PG snapshots and exact manifest, with documented omissions and no global atomicity claim",
    "Create fresh ciphertext and exact Storage Share object, read back ciphertext and receipt by strong ETag/hash, independently retrieve using operator custody",
    "Attended independent age-key proof: wrong-key denial, complete archive hashes, SQLite/RSA checks, disposable native PostgreSQL restore and verified cleanup before timer activation",
    "Full NK49 closure separately requires native directory/issuer/MFA authentication, retained token decryption, audit signature continuity, current callers and legacy credential dispositions; archive acceptance does not close those gates",
    "Host-local health cannot report a dead host; external outage monitoring and second-provider copy remain separate coverage gaps"
  ],
  "runtime_host": {
    "ssh_alias": "railiance01",
    "hostname": "239.62.205.92.host.secureserver.net",
    "machine_id_sha256": "fe7367a60951922122af7ba18ed2cde65c7e0a232bbedfb045cb575de2094c2f"
  }
}