net-kingdom/tools/bootstrap-recovery/identity-backup-profile.json

{
  "schema": "netkingdom.identity-backup-profile.v1",
  "status": "proposed",
  "owner": "net-kingdom with railiance-platform/rapp-postgres runtime and storage admission",
  "public_recipient": "age1zvryunvjhvpkmasskauga2heeg0ztnte9ymgppvjge36ekumk50syr3tsz",
  "archive_profile": "netkingdom-identity-v1; new profile, not the bootstrap secrets-only tar profile",
  "components": [
    {
      "namespace": "sso",
      "deployment": "lldap",
      "deployment_uid": "743a86bd-5cb0-4ca0-9c56-a3438f4746a8",
      "pvc_refs": [
        {
          "name": "lldap-data",
          "uid": "0a06b65a-e7b3-42d3-916e-e74dbe5fc7da"
        }
      ],
      "secret_refs": [
        "lldap-secrets"
      ],
      "configmap_refs": [],
      "required_assets": [
        "SQLite online-backup snapshot of /data/users.db with integrity check",
        "remaining non-backup durable /data files, including any private identity material",
        "current deployment configuration and exact lldap-secrets fields"
      ],
      "native_acceptance": [
        "directory user/group/membership preservation",
        "existing-user password authentication in isolated environment"
      ]
    },
    {
      "namespace": "sso",
      "deployment": "authelia",
      "deployment_uid": "dc40a925-2306-4a3b-89c0-e714187503c3",
      "pvc_refs": [
        {
          "name": "authelia-data",
          "uid": "86826554-b014-4df4-8b28-866aa64f6413"
        }
      ],
      "secret_refs": [
        "authelia-secrets",
        "authelia-smtp"
      ],
      "configmap_refs": [
        "authelia-config"
      ],
      "required_assets": [
        "SQLite online-backup snapshot of /var/authelia/data/db.sqlite3 with integrity check",
        "current configuration.yml and all Secret-mounted encryption/OIDC/session fields",
        "explicit disposition for notifier credentials and remaining durable files"
      ],
      "native_acceptance": [
        "storage decryption",
        "same OIDC signing identity and preserved client configuration",
        "isolated authentication flow with outbound notification disabled"
      ]
    },
    {
      "namespace": "sso",
      "deployment": "keycape",
      "deployment_uid": "99ddd83c-cb3f-4847-bcf8-35f1aa87627f",
      "pvc_refs": [
        {
          "name": "keycape-authentication-policy",
          "uid": "423f558f-8c11-4edf-956b-243559df4a8e"
        }
      ],
      "secret_refs": [
        "keycape-approval-engine-operator-client",
        "keycape-config",
        "keycape-factor-read",
        "keycape-informed-decision-sitting-requester-client",
        "keycape-rapp-qonto-client",
        "keycape-secrets-engine-approval-client",
        "keycape-secrets-engine-openbao-client",
        "keycape-secrets-engine-requester-client"
      ],
      "configmap_refs": [],
      "required_assets": [
        "exact current keycape-config config.yaml and key.pem",
        "complete stable policy/receipt PVC snapshot",
        "current deployment and owner disposition for every referenced credential: encrypted recovery or independently recoverable provider reissue path"
      ],
      "native_acceptance": [
        "same issuer/JWKS signing identity",
        "registry, authentication policy and receipt continuity",
        "current consumer positive/negative authentication under isolated test endpoints"
      ]
    },
    {
      "namespace": "mfa",
      "deployment": "privacyidea",
      "deployment_uid": "58c7f96d-61cb-4dd4-bca2-54661c0ac375",
      "pvc_refs": [
        {
          "name": "privacyidea-data",
          "uid": "65650fc1-02d8-4c0f-84fc-e0015c8f3ed9"
        },
        {
          "name": "privacyidea-logs",
          "uid": "39fa90d9-bc54-4a03-a0d6-ae85165e0cb9"
        }
      ],
      "secret_refs": [
        "privacyidea-config"
      ],
      "configmap_refs": [
        "factor-recovery-01119187d90d7b76",
        "keycape-onboarding-9465e5e0b98f7986",
        "privacyidea-cfg"
      ],
      "required_assets": [
        "original /etc/privacyidea/enckey, private.pem and public.pem with matching RSA pair validation",
        "current privacyidea-config and mounted configuration/scripts",
        "bounded native PostgreSQL custom dump with exact database identity and key-generation linkage",
        "explicit disposition for service logs; audit database/signatures must be preserved"
      ],
      "native_acceptance": [
        "decrypt existing retained token material without exporting it",
        "verify pre-backup audit signatures and create/verify a new isolated audit entry",
        "existing-token MFA and negative-key refusal"
      ]
    }
  ],
  "capture_contract": {
    "plaintext": "private task staging outside Git; never process output, State Hub or logs; verified cleanup after encryption",
    "consistency": "native SQLite online-backup and PostgreSQL logical snapshot; explicit capture interval per asset; no global atomic snapshot claim; before/after source identities/config versions and directory inventories must match",
    "key_policy": "preserve original service keys; no age private key in the payload, no replacement generation, no root/unseal collection",
    "encryption": "public-recipient-only streaming archive to age; private fresh ciphertext, no overwrite; manifest inside ciphertext with source identities, times, complete required paths, digests and omissions",
    "limits": "measure first; proposed 512 MiB encrypted admission ceiling, no silent truncation/exclusions",
    "historical_database": "existing verified October15 dump remains protected; new bundle must link its own exact database/key capture generation and recovery receipt"
  },
  "proposed_destinations": {
    "primary": "s3://railiance-platform-pg-backup/platform-pg/application-archives/net-kingdom/",
    "secondary": "Storage Share Backup/railiance-backups/net-kingdom-identity/",
    "admitted": false,
    "publisher": "new exact prefix-scoped owner-delivered publisher; do not borrow another workload reader or bootstrap API key",
    "retention": "initial single verified generation; later seven daily/two weekly only after measured quota/overlap/headroom and separately admitted retention executor; never expire existing good backups",
    "schedule": "not installed; propose daily capture after logical database backup with per-generation linkage, separate failure alert and operator-approved RPO/RTO"
  },
  "admission_gates": [
    "Railiance owner accepts exact read/capture executor, immutable helper images, PVC access and task-scoped caller attribution; no production stop/restart inferred",
    "NetKingdom/service owners accept full asset manifest, original key preservation, consistency interval, bounded recovery environment and native acceptance",
    "Platform/reef-storage admits both new archive prefixes, immutable create/readback, scoped publisher custody and current quota/headroom; current application archive profiles do not include net-kingdom",
    "Resolve every referenced credential through encrypted recovery or an independent owner reissue path; no undocumented grant propagation",
    "Implement and test capture/sealing/transfer adapters against this new profile before live execution; existing bootstrap tar checker is insufficient",
    "Retrieve by immutable object/version from each admitted provider; digest check, attended independent-key decryption, native service recovery, failed-key case and verified cleanup",
    "Only then enable recurring capture/alerts and measured retention; preserve T02 legacy provider-credential and deferred-rotation boundaries"
  ]
}