tegwick
7ce58ae638
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a0291a-1e87-7151-9934-fcbfe3f65eb1
131 lines
4.9 KiB
Markdown
131 lines
4.9 KiB
Markdown
# Railiance Offsite Backup Lane
|
|
|
|
Date: 2026-07-16
|
|
Catalog: `railiance-backup-offsite-lane` (status `active`, `resolvable: true`, `risk: high`)
|
|
Owner: `railiance-platform` (CCR-2026-0004)
|
|
|
|
Nextcloud WebDAV upload token and URL for age-encrypted offsite backups (Option A).
|
|
Used by `railiance-backup` (workstation) and `forgejo-backup` (platform).
|
|
|
|
---
|
|
|
|
## OpenBao pointers
|
|
|
|
| Field | Value |
|
|
| --- | --- |
|
|
| Mount | `platform` |
|
|
| Path | `platform/workloads/railiance/backup/offsite-lane` |
|
|
| Fields | `NC_WEBDAV_TOKEN` (primary fetch), `NC_WEBDAV_URL`, `AGE_PRIVATE_KEY` (recovery escrow) |
|
|
| Policy | `workload-kv-read-railiance-backup-offsite-lane` (operator OIDC) |
|
|
| Agent policy | `agent-high-risk-boundary` — **deny** data-read; metadata only |
|
|
| OIDC role | `railiance-backup-workload-kv-read` (`groups=net-kingdom-admins`) |
|
|
| Risk | `high` (upload token + age recovery escrow) |
|
|
|
|
---
|
|
|
|
## Worker checklist
|
|
|
|
1. **Login** (caller identity — ops-warden adds no credential):
|
|
|
|
```bash
|
|
bao login -method=oidc -path=netkingdom role=railiance-backup-workload-kv-read
|
|
```
|
|
|
|
2. **Export for a backup run** (sanctioned transports — never paste into chat):
|
|
|
|
```bash
|
|
# Preferred: file or exec injection via warden
|
|
warden access railiance-backup-offsite-lane --out /tmp/nc.token
|
|
# or:
|
|
warden access railiance-backup-offsite-lane --exec -- env | grep -v .
|
|
```
|
|
|
|
If you must use raw bao in an interactive human shell (not an agent session):
|
|
|
|
```bash
|
|
export RAILIANCE_BACKUP_NC_TOKEN=$(
|
|
bao kv get -field=NC_WEBDAV_TOKEN platform/workloads/railiance/backup/offsite-lane
|
|
)
|
|
export RAILIANCE_BACKUP_NC_WEBDAV_URL=$(
|
|
bao kv get -field=NC_WEBDAV_URL platform/workloads/railiance/backup/offsite-lane
|
|
)
|
|
```
|
|
|
|
3. **Proxy via warden access** (catalog active + resolvable):
|
|
|
|
```bash
|
|
warden access railiance-backup-offsite-lane --fetch --out /tmp/nc.token
|
|
# Primary field is NC_WEBDAV_TOKEN. AGE_PRIVATE_KEY is recovery escrow only.
|
|
```
|
|
|
|
4. **Run backup**:
|
|
|
|
```bash
|
|
# workstation custodian DB + config
|
|
bin/railiance backup
|
|
|
|
# Forgejo production (from railiance-platform checkout)
|
|
tools/cmd/forgejo-backup
|
|
```
|
|
|
|
`AGE_PRIVATE_KEY` in the same path is recovery escrow — fetch only for restore drills.
|
|
**Agents** (`WARDEN_AGENT_ID` set) cannot stream raw high-risk values; use `--out` /
|
|
`--exec` / `--wrap`. See `wiki/playbooks/agent-read-boundary.md`.
|
|
|
|
---
|
|
|
|
## Verify the lane (capabilities-safe — never read the value)
|
|
|
|
Prove allow/deny with `bao token capabilities`, **not** `bao kv get`. Reading the
|
|
value to "confirm" it triggered the 2026-07-16 disclosure of `NC_WEBDAV_TOKEN` /
|
|
`NC_WEBDAV_URL` / `AGE_PRIVATE_KEY` (see `history/2026-07-16-credential-disclosure-lessons.md`).
|
|
|
|
```bash
|
|
# Positive: lane policy identity can read the data path
|
|
LANE=$(bao token create -policy=workload-kv-read-railiance-backup-offsite-lane -ttl=2m -field=token)
|
|
bao token capabilities "$LANE" platform/data/workloads/railiance/backup/offsite-lane
|
|
# → expect: read
|
|
bao token revoke "$LANE"
|
|
|
|
# Negative: default-only identity is denied (no value is read)
|
|
DEFAULT_TOKEN=$(bao token create -policy=default -field=token) # if this is denied, that IS the pass — do NOT fall back
|
|
bao token capabilities "$DEFAULT_TOKEN" platform/data/workloads/railiance/backup/offsite-lane
|
|
# → expect: deny
|
|
bao token revoke "$DEFAULT_TOKEN"
|
|
|
|
# Agent boundary: data deny, metadata allow
|
|
AGENT=$(bao token create -policy=agent-high-risk-boundary -ttl=2m -field=token)
|
|
bao token capabilities "$AGENT" platform/data/workloads/railiance/backup/offsite-lane # deny
|
|
bao token capabilities "$AGENT" platform/metadata/workloads/railiance/backup/offsite-lane # read
|
|
bao token revoke "$AGENT"
|
|
```
|
|
|
|
The capability lists contain no secret material — safe to record on
|
|
`CCR-2026-0004` as promotion evidence. Full pattern:
|
|
`wiki/playbooks/catalog-lane-promotion.md#capabilities-safe-lane-verification`.
|
|
|
|
### Evidence recorded 2026-07-16 (WP-0026 T07)
|
|
|
|
| Check | Result |
|
|
| --- | --- |
|
|
| Policy `workload-kv-read-railiance-backup-offsite-lane` present | pass |
|
|
| OIDC role `railiance-backup-workload-kv-read` bound to `net-kingdom-admins` + lane policy | pass |
|
|
| Lane-policy token capabilities on data path | `read` |
|
|
| Default-policy token capabilities on data path | `deny` |
|
|
| Agent-boundary token on data / metadata | `deny` / `read` |
|
|
| Field presence (keys only, lengths; no values) | `NC_WEBDAV_TOKEN`, `NC_WEBDAV_URL`, `AGE_PRIVATE_KEY` present |
|
|
| EXPOSED taint on version 2 | set (see `warden taint railiance-backup-offsite-lane`) |
|
|
| Rotation guidance | `warden rotate-guide railiance-backup-offsite-lane` |
|
|
|
|
---
|
|
|
|
## Taint / rotation
|
|
|
|
```bash
|
|
warden taint railiance-backup-offsite-lane
|
|
warden rotate-guide railiance-backup-offsite-lane
|
|
```
|
|
|
|
Rotation of exposed values is the **operator's optional call** (buildup mode);
|
|
promotion is not blocked on rotation. After rotation, clear `exposed_*`
|
|
custom_metadata keys (`wiki/playbooks/exposed-taint.md`).
|