coulomb/ops-warden
4
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions
ops-warden/wiki/playbooks/railiance-backup-offsite-lane.md
tegwick b971403dad
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
WARDEN-WP-0026 finish Strand A (T04/T05/T07) 
Promote railiance-backup-offsite-lane to active/resolvable after
capabilities-safe re-verify. Add catalog risk=high, agent read-boundary
(exit 7 + OpenBao policy companion), EXPOSED taint via warden taint, and
close WP-0026.
2026-07-16 23:26:26 +02:00

4.9 KiB
Raw Blame History

Railiance Offsite Backup Lane

Date: 2026-07-16
Catalog: railiance-backup-offsite-lane (status active, resolvable: true, risk: high)
Owner: railiance-platform (CCR-2026-0004)

Nextcloud WebDAV upload token and URL for age-encrypted offsite backups (Option A). Used by railiance-backup (workstation) and forgejo-backup (platform).

OpenBao pointers

Field Value
Mount platform
Path platform/workloads/railiance/backup/offsite-lane
Fields NC_WEBDAV_TOKEN (primary fetch), NC_WEBDAV_URL, AGE_PRIVATE_KEY (recovery escrow)
Policy workload-kv-read-railiance-backup-offsite-lane (operator OIDC)
Agent policy agent-high-risk-boundary — deny data-read; metadata only
OIDC role railiance-backup-workload-kv-read (groups=net-kingdom-admins)
Risk high (upload token + age recovery escrow)

Worker checklist

  1. Login (caller identity — ops-warden adds no credential):

    bao login -method=oidc -path=netkingdom role=railiance-backup-workload-kv-read

  2. Export for a backup run (sanctioned transports — never paste into chat):

    # Preferred: file or exec injection via warden
warden access railiance-backup-offsite-lane --no-policy --out /tmp/nc.token
# or:
warden access railiance-backup-offsite-lane --no-policy --exec -- env | grep -v .

    If you must use raw bao in an interactive human shell (not an agent session):

    export RAILIANCE_BACKUP_NC_TOKEN=$(
  bao kv get -field=NC_WEBDAV_TOKEN platform/workloads/railiance/backup/offsite-lane
)
export RAILIANCE_BACKUP_NC_WEBDAV_URL=$(
  bao kv get -field=NC_WEBDAV_URL platform/workloads/railiance/backup/offsite-lane
)

  3. Proxy via warden access (catalog active + resolvable):

    warden access railiance-backup-offsite-lane --no-policy --fetch --out /tmp/nc.token
# Primary field is NC_WEBDAV_TOKEN. AGE_PRIVATE_KEY is recovery escrow only.

  4. Run backup:

    # workstation custodian DB + config
bin/railiance backup

# Forgejo production (from railiance-platform checkout)
tools/cmd/forgejo-backup

AGE_PRIVATE_KEY in the same path is recovery escrow — fetch only for restore drills. Agents (WARDEN_AGENT_ID set) cannot stream raw high-risk values; use --out / --exec / --wrap. See wiki/playbooks/agent-read-boundary.md.

Verify the lane (capabilities-safe — never read the value)

Prove allow/deny with bao token capabilities, not bao kv get. Reading the value to "confirm" it triggered the 2026-07-16 disclosure of NC_WEBDAV_TOKEN / NC_WEBDAV_URL / AGE_PRIVATE_KEY (see history/2026-07-16-credential-disclosure-lessons.md).

# Positive: lane policy identity can read the data path
LANE=$(bao token create -policy=workload-kv-read-railiance-backup-offsite-lane -ttl=2m -field=token)
bao token capabilities "$LANE" platform/data/workloads/railiance/backup/offsite-lane
#   → expect: read
bao token revoke "$LANE"

# Negative: default-only identity is denied (no value is read)
DEFAULT_TOKEN=$(bao token create -policy=default -field=token)   # if this is denied, that IS the pass — do NOT fall back
bao token capabilities "$DEFAULT_TOKEN" platform/data/workloads/railiance/backup/offsite-lane
#   → expect: deny
bao token revoke "$DEFAULT_TOKEN"

# Agent boundary: data deny, metadata allow
AGENT=$(bao token create -policy=agent-high-risk-boundary -ttl=2m -field=token)
bao token capabilities "$AGENT" platform/data/workloads/railiance/backup/offsite-lane   # deny
bao token capabilities "$AGENT" platform/metadata/workloads/railiance/backup/offsite-lane # read
bao token revoke "$AGENT"

The capability lists contain no secret material — safe to record on CCR-2026-0004 as promotion evidence. Full pattern: wiki/playbooks/catalog-lane-promotion.md#capabilities-safe-lane-verification.

Evidence recorded 2026-07-16 (WP-0026 T07)

Check Result
Policy workload-kv-read-railiance-backup-offsite-lane present pass
OIDC role railiance-backup-workload-kv-read bound to net-kingdom-admins + lane policy pass
Lane-policy token capabilities on data path read
Default-policy token capabilities on data path deny
Agent-boundary token on data / metadata deny / read
Field presence (keys only, lengths; no values) NC_WEBDAV_TOKEN, NC_WEBDAV_URL, AGE_PRIVATE_KEY present
EXPOSED taint on version 2 set (see warden taint railiance-backup-offsite-lane)
Rotation guidance warden rotate-guide railiance-backup-offsite-lane

Taint / rotation

warden taint railiance-backup-offsite-lane
warden rotate-guide railiance-backup-offsite-lane

Rotation of exposed values is the operator's optional call (buildup mode); promotion is not blocked on rotation. After rotation, clear exposed_* custom_metadata keys (wiki/playbooks/exposed-taint.md).