tegwick
661176e37a
CoulombCore is being retired, so the docs stop using it as the reference host: state-hub-coulombcore examples become state-hub-railiance01, and the reuse-surface playbook no longer attributes bao.coulomb.social to it — that resolves to 92.205.62.239, which is railiance01. The openrouter lane keeps its factual note about ESO on the CoulombCore cluster, with a retirement flag for its owner. Also corrects this session's own error. The WP-0031 evidence blamed the Unauthorized on a local-port collision between k3s-api-coulombcore and k3s-api-haskelseed. That was wrong: the haskelseed tunnel is a reverse forward, where local_port is a destination rather than a listener, so they never competed. 16443 was simply CoulombCore's k3s — a different cluster whose client CA does not know that cert. The wrong reason had already gone to flex-auth, so it is corrected in the file rather than quietly dropped. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
90 lines
No EOL
3.4 KiB
Markdown
90 lines
No EOL
3.4 KiB
Markdown
# reuse-surface Hub Write Token — OpenBao Custody
|
|
|
|
Date: 2026-07-07 (promoted active 2026-07-07)
|
|
Workplan: RAILIANCE-WP-0011-T03 · CCR-2026-0005
|
|
Catalog: `reuse-surface-hub-write-token` (**active** — path live, ESO delivering)
|
|
|
|
Bearer token for authenticated writes to the production federation hub at
|
|
`https://reuse.coulomb.social` (`POST /v1/repos`, `reuse-surface hub register`).
|
|
ops-warden does not vend this token — custody belongs to `railiance-platform`
|
|
(OpenBao) and the `reuse-surface` workload via External Secrets.
|
|
|
|
---
|
|
|
|
## Owner-confirmed lane (no placeholders)
|
|
|
|
| Field | Value |
|
|
| --- | --- |
|
|
| OpenBao server | `https://bao.coulomb.social` (railiance01, `92.205.62.239`) |
|
|
| KV path | `platform/workloads/reuse/reuse-surface/runtime-secrets` |
|
|
| Hub write field | `REUSE_SURFACE_TOKEN` |
|
|
| Webhook HMAC field | `REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET` |
|
|
| Read policy | `workload-kv-read-reuse-surface-runtime` |
|
|
| ESO delivery | `ExternalSecret reuse/reuse-surface-runtime` → `reuse-surface-env` (Railiance01) |
|
|
| Deploy runbook | `railiance-apps/docs/reuse-surface-on-railiance01.md` |
|
|
| Hub API spec | `reuse-surface/specs/FederationHubAPI.md` |
|
|
|
|
**Promotion gate (met 2026-07-07):** path seeded, `ExternalSecret reuse/reuse-surface-runtime`
|
|
`SecretSynced`, positive hub + webhook verification and negative default-policy denial
|
|
recorded in CCR-2026-0005.
|
|
|
|
### Break-glass (cluster read)
|
|
|
|
If OpenBao is unreachable, operators with Railiance01 kubeconfig may read the
|
|
materialized Secret (ESO cache):
|
|
|
|
```bash
|
|
kubectl --kubeconfig ~/.kube/config-hosteurope get secret reuse-surface-env -n reuse \
|
|
-o jsonpath='{.data.REUSE_SURFACE_TOKEN}' | base64 -d
|
|
```
|
|
|
|
Never paste values into chat, State Hub, workplans, or Git.
|
|
|
|
---
|
|
|
|
## Worker checklist
|
|
|
|
1. **Confirm OpenBao reachability** (you act as yourself; ops-warden adds no credential):
|
|
```bash
|
|
bao kv metadata get platform/workloads/reuse/reuse-surface/runtime-secrets
|
|
```
|
|
|
|
2. **Export hub write token for a shell session** (streams to your terminal):
|
|
```bash
|
|
export REUSE_SURFACE_URL=https://reuse.coulomb.social
|
|
export REUSE_SURFACE_TOKEN=$(
|
|
bao kv get -field=REUSE_SURFACE_TOKEN \
|
|
platform/workloads/reuse/reuse-surface/runtime-secrets
|
|
)
|
|
```
|
|
|
|
3. **Or proxy via warden access** (same `bao kv get`, audited metadata only):
|
|
```bash
|
|
warden route show reuse-surface-hub-write-token --json
|
|
warden access reuse-surface-hub-write-token --no-policy --fetch
|
|
```
|
|
|
|
4. **Webhook HMAC** (same path, second field — must match Forgejo org webhook):
|
|
```bash
|
|
bao kv get -field=REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET \
|
|
platform/workloads/reuse/reuse-surface/runtime-secrets
|
|
```
|
|
After rotation: `railiance-apps` `make reuse-forgejo-webhook`.
|
|
|
|
5. **Register a repo** after publish-check passes:
|
|
```bash
|
|
reuse-surface hub status
|
|
reuse-surface hub register --repo <slug> \
|
|
--url <forgejo-raw-capabilities-yaml-url> \
|
|
--domain <domain>
|
|
```
|
|
|
|
6. **Verify federated index** picked up the new source:
|
|
```bash
|
|
curl -fsS "$REUSE_SURFACE_URL/v1/federated" | jq '.sources | map(.repo) | index("<slug>")'
|
|
```
|
|
|
|
Rotation: `railiance-platform/docs/reuse-surface-runtime-secrets-rotation-runbook.md`
|
|
(OpenBao patch → ESO `force-sync` → hub rollout → `make reuse-forgejo-webhook` when
|
|
the webhook HMAC changes → `make reuse-webhook-smoke`). Lifecycle:
|
|
`railiance-platform/docs/credential-lane-lifecycle-runbook.md` (CCR-2026-0005). |