coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
net-kingdom/docs/evidence/2026-10-31-nk56-svc-authelia-bind/README.md
tegwick 7f37e2521f
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details
NK-WP-0056-T04: svc-authelia bind delivered from OpenBao; setup and verify receipts 
Founder-run under CCR-2026-0053: setup (custody equal to live, KV v1 CAS=0),
ESO apply, verify and Authelia restart passed; admin signed in with OTP.
Custody copy re-sealed after setup (same recipient, contents unchanged).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 896183@bnt-lap001
Assistant-Session: 3a18c01a-3205-4d02-94db-9efff25649a2
2026-10-31 10:11:07 +01:00

1.7 KiB
Raw Blame History

NK-WP-0056-T04 — svc-authelia bind in platform custody (2026-10-31)

Founder-run in the founder's terminal under railiance-platform CCR-2026-0053 (approved by platform-owner and net-kingdom-owner, binding confirmed, bcfbe29; sha256 11d0b02c…f187). Tool: tools/service-binds/bind-lane.py at 034634a (source sha256 3d15811c…). All receipts are value-free (values_recorded: false).

Step Result Receipt
setup (attended platform-admin, custody decrypted, re-sealed and shredded after) live authelia-config binds uid=svc-authelia; custody equal to live ldap_password; coding agents fenced; KV version 1 (CAS=0); policy and role in place 01-setup.json
apply sso-mfa/k8s/authelia/bind-eso.yaml ServiceAccount, SecretStore and ExternalSecret created; ExternalSecret Ready on first apply (the pilot's template.metadata: {} fix carried over) operator output
verify exact policy/TTL; wrong ServiceAccount and audience denied; metadata, the other directory-bind paths and token create denied; KV equals the delivered ldap_password; temporary reader revoked 02-verify.json
restart Authelia rolled out; founder signed in through the portal as admin with OTP (Authelia session admin, account site aal2) operator output

svc-authelia's bind password is now delivered from OpenBao (platform/workloads/net-kingdom/directory-binds/svc-authelia) into the ldap_password key only; the session, storage and OIDC keys of authelia-secrets are untouched. The custody copy still holds the same value as a fallback. Rotation: change the password in LLDAP, write the next KV version with CAS, restart Authelia (it reads the file only at start-up). Remaining lanes: svc-keycape, svc-privacyidea.