coulomb/railiance-bootstrap
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

docs(recovery): verify actual identity archive recovery and active backups
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a13eab-1e6a-7b33-9c37-372e90ada3a2
This commit is contained in:
tegwick 2026-10-16 09:38:31 +02:00
parent aa434d8dec
commit d1dcfde527
1 changed files with 1 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
docs/identity-recovery.md
View file

@ -3,7 +3,7 @@
Use this handoff when recovering an existing Railiance identity, before introducing new issuer or MFA keys. `railiance-bootstrap` sequences recovery; NetKingdom owns identity capture and acceptance, S1/S2 own the replacement host/cluster and S3 owns database/custody service recovery. There is no automatic bare-VM production restore.
1. Independently obtain the reviewed repositories/toolchain and the `railiance-backup` age key from offline/password-safe custody. Do not depend on the failed SSO or OpenBao instance to obtain these. The key stays in the operator's hidden terminal.
2. Retrieve the exact encrypted `net-kingdom-identity-*.tar.age` generation and safe transfer receipt from Storage Share `Backup/railiance-backups/net-kingdom-identity/`. The first full bundle was captured and Storage Share readback verified on2026-10-16; independent human-key full archive and full-service recovery remain pending. Existing privacyIDEA database-only dumps do not include service keys. Runtime publisher/retention shares are not recovery authority. During a healthy attended drill, NetKingdom `retrieve-identity.py` binds an independent Backup-account download by strong ETag/size/SHA256. That helper currently uses a healthy OpenBao custody path: during total custody loss, use independently held provider access to download and obtain an owner-reviewed transfer receipt before verification. That offline provider adapter is not implemented here.
2. Retrieve the exact encrypted `net-kingdom-identity-*.tar.age` generation and safe transfer receipt from Storage Share `Backup/railiance-backups/net-kingdom-identity/`. The first full bundle was captured and Storage Share readback verified on2026-10-16; independent human-key full archive recovery also passed and daily backup/hourly health are active. Full native service authentication/audit continuity and production import remain separate acceptance. Existing privacyIDEA database-only dumps do not include service keys. Runtime publisher/retention shares are not recovery authority. During a healthy attended drill, NetKingdom `retrieve-identity.py` binds an independent Backup-account download by strong ETag/size/SHA256. That helper currently uses a healthy OpenBao custody path: during total custody loss, use independently held provider access to download and obtain an owner-reviewed transfer receipt before verification. That offline provider adapter is not implemented here.
3. Follow the exact NetKingdom [recovery ceremony](../../net-kingdom/docs/bootstrap-recovery-ceremony.md). On a healthy workstation with age and Docker, invoke the bootstrap handoff through the hidden-key wrapper:
```bash