3f5f0b6e77
Names Host Europe/GoDaddy vps4 (OpenStack Nova KVM) and the VPS control panel as the console surface, records what is unverified, and defines a value-safe pre-window attestation receipt. Adds RAIL-HO-WP-0011-T09 for the founder to confirm and test console access. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 680842@bnt-lap001 Assistant-Session: 54eb9e8e-7d6b-4f0c-b7a6-a6db62075883
109 lines
5.5 KiB
Markdown
109 lines
5.5 KiB
Markdown
# railiance01 provider console and rescue access
|
|
|
|
Status: **partly established, console path untested.** Do not treat provider
|
|
console access as proven for a maintenance window until an attestation receipt
|
|
exists (see below). Follow-up task: `RAIL-HO-WP-0011-T09`.
|
|
|
|
Consumer: `railiance-platform/docs/railiance01-coordinated-reboot.md`
|
|
(`RPF-WP-0015-T03`), which requires "independent provider-console access, not
|
|
SSH alone" before a reboot.
|
|
|
|
This document holds no credentials, customer numbers, session URLs, or console
|
|
tokens, and must never hold them.
|
|
|
|
## Established from records
|
|
|
|
| Fact | Value | Source |
|
|
| --- | --- | --- |
|
|
| Host | railiance01, `92.205.62.239`, `239.62.205.92.host.secureserver.net` | `docs/evidence/resource-hosteurope-railiance01/identity-lifecycle.yaml` |
|
|
| Provider | Host Europe GmbH (AS21499), parent GoDaddy. `secureserver.net` is the GoDaddy hosting domain | same |
|
|
| Product | Virtual server, family `vps4`, instance type `oh.hosting.c2.r4.d100` | same (measured from cloud-init) |
|
|
| Platform | KVM guest on OpenStack Nova, site `sxb1` (Strasbourg, FR) | same; `railiance-clock/docs/evidence/2026-09-14-host-time-inventory.md` |
|
|
| Non-secret instance identity | Nova UUID `c0e697d1-4c71-40f5-9746-0b4c4b9e5c17`, instance name `1fxw7h4zug` | `identity-lifecycle.yaml` |
|
|
| Management surface | Host Europe / GoDaddy VPS control panel. There is no provider API for this product class | `labor-and-exit.yaml` (`panel`, `provider_api: none`) |
|
|
| Provider agent | Nydus (`nydus-ex-api`) on 2224/tcp, in-guest (see note) | `railiance-hosts/hosteurope/260308-dependency-nydus.md` |
|
|
| Account holder | The founder/operator. The billing customer number is classified `restricted`, owner `operator` | `identity-lifecycle.yaml`; `resource-control/docs/evidence/RESOURCE-WP-0002-host-europe-resolution-2026-08-15.md` |
|
|
|
|
Nydus note: the provider's onboarding text
|
|
(`railiance-hosts/hosteurope/260308-dependency-nydus.md`) describes Nydus as an
|
|
in-guest agent on **2224/tcp** that connects the server to the provider
|
|
platform for server access, root-password reset, and backups. UFW allows 2224
|
|
deliberately (`docs/evidence/RAIL-HO-WP-0009-T03-declared-vs-live-audit.md`).
|
|
Nydus runs inside the guest and needs guest networking, so it is **not** an
|
|
independent console. It fails in the same cases where SSH fails.
|
|
|
|
## Not established
|
|
|
|
No record in `railiance-*`, `resource-control`, or `the-custodian/docs` says any
|
|
of the following. Do not assume them:
|
|
|
|
1. Whether the panel offers an out-of-band console for this `vps4` product
|
|
(browser VNC/noVNC, serial, or similar), and whether it works while guest
|
|
networking or SSH is down. OpenStack Nova *can* expose a VNC console, but
|
|
that the provider exposes one here is unverified.
|
|
2. Whether a rescue boot mode or rescue image exists, and what it does to the
|
|
root disk.
|
|
3. Whether the panel can force a hard reboot or power cycle independently of
|
|
the guest.
|
|
4. Which login identity can reach the panel, whether it uses MFA, and whether
|
|
anyone other than the founder has delegated access. As far as the records
|
|
show, there is one access holder: the founder.
|
|
5. Whether console access has ever been exercised. No receipt exists.
|
|
|
|
Until items 1, 3 and 5 are confirmed, the coordinated-reboot gate
|
|
"independent provider-console access" **cannot be satisfied**. SSH plus Nydus
|
|
is not independent.
|
|
|
|
## Roles
|
|
|
|
| Role | Holds | Duty |
|
|
| --- | --- | --- |
|
|
| Host Europe account holder (founder) | Panel login and any MFA factor, outside every repo | Confirms the mechanism once (T09) and attests before each window |
|
|
| `railiance-infra` host operator | No provider credential, unless the founder delegates | Records the receipt and runs reboot/recovery using the attested path |
|
|
|
|
If the founder is the only access holder, the founder must be present for the
|
|
whole reboot window, or must name a delegate in the panel beforehand. The
|
|
receipt records only the role, never the identity.
|
|
|
|
## Pre-window attestation
|
|
|
|
On the same day as the window, and before the preflight step "Prove
|
|
provider-console access and SSH access", the access holder:
|
|
|
|
1. Logs in to the Host Europe / GoDaddy VPS panel.
|
|
2. Selects the server whose instance identity matches the non-secret values
|
|
above.
|
|
3. Opens the console and confirms that it shows the railiance01 login prompt
|
|
or the boot output. Do not log in through the console unless that is
|
|
required.
|
|
4. Notes whether rescue mode and hard reboot are offered. Do not trigger
|
|
either.
|
|
5. Closes the console session.
|
|
|
|
The host operator records a receipt at
|
|
`docs/evidence/railiance01-console-access/<receipt_id>.yaml`. The receipt id
|
|
format is `RAIL01-CONSOLE-<YYYYMMDDTHHMMSSZ>`:
|
|
|
|
```yaml
|
|
receipt_id: RAIL01-CONSOLE-20261015T080000Z
|
|
host: railiance01
|
|
provider_resource_id: c0e697d1-4c71-40f5-9746-0b4c4b9e5c17
|
|
attested_by_role: host-europe-account-holder # role, never a name or login
|
|
attested_at: "2026-10-15T08:00:00Z"
|
|
panel_login: ok
|
|
mfa_used: true | false | unknown
|
|
console_mechanism: <as named in the panel, e.g. "VNC console">
|
|
console_shows_host: true
|
|
independent_of_guest_network: true | false | unknown
|
|
rescue_mode_offered: true | false | unknown
|
|
hard_reboot_offered: true | false | unknown
|
|
reboot_window_id: <approved window id>
|
|
```
|
|
|
|
Forbidden in the receipt, the hub, or any prompt: passwords, MFA codes,
|
|
customer or contract numbers, console URLs (they often embed session tokens),
|
|
screenshots that show account data, and the root password.
|
|
|
|
The reboot preflight should accept only a receipt that is from the same day as
|
|
the window, names the window id, and has `console_shows_host: true` and
|
|
`independent_of_guest_network: true`.
|