2026-08-14 16:58:44 +02:00
|
|
|
# Put the Scaleway bootstrap key (founder, local only)
|
|
|
|
|
|
|
|
|
|
Do this on a trusted terminal. **Do not paste ACCESS_KEY or SECRET_KEY
|
|
|
|
|
into chat, Git, or State Hub.**
|
|
|
|
|
|
|
|
|
|
CCR: `railiance-platform/credential-change-requests/CCR-2026-0011-scaleway-object-storage-bootstrap.yaml`
|
|
|
|
|
Path: `platform/workloads/railiance/scaleway/bootstrap`
|
|
|
|
|
|
|
|
|
|
1. In [console.scaleway.com](https://console.scaleway.com) create or reuse
|
|
|
|
|
the Railiance (or GmbH) project. IAM → API keys: create a key that can
|
|
|
|
|
create Object Storage buckets in that project. Copy org id and project id
|
|
|
|
|
from the project dashboard (those two are not as sensitive as the secret
|
|
|
|
|
key, but still keep them out of git).
|
|
|
|
|
2. On this host, with a token that can write the `platform` mount:
|
|
|
|
|
|
|
|
|
|
```bash
|
|
|
|
|
bao kv put platform/workloads/railiance/scaleway/bootstrap \
|
|
|
|
|
ACCESS_KEY='SCWxxxxxxxx' \
|
|
|
|
|
SECRET_KEY='xxxxxxxx' \
|
|
|
|
|
DEFAULT_ORGANIZATION_ID='xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx' \
|
|
|
|
|
DEFAULT_PROJECT_ID='xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx'
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
3. Confirm **without printing values**:
|
|
|
|
|
|
|
|
|
|
```bash
|
|
|
|
|
bao kv metadata get platform/workloads/railiance/scaleway/bootstrap
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
You should see a current version. Then tell the agent “bootstrap is in
|
|
|
|
|
OpenBao.” They will run `tools/create-platform-audit-bucket.sh`, which
|
|
|
|
|
creates the private Multi-AZ bucket, 30-day lifecycle, and writes only
|
|
|
|
|
endpoint/bucket/region into `substrate/object-stores/platform-audit-storage.yaml`.
|
|
|
|
|
|
2026-08-14 19:19:56 +02:00
|
|
|
The scoped backup key is a **different** path
|
|
|
|
|
(`platform/workloads/railiance/backup/object-storage`) and is T04.
|
2026-08-14 16:58:44 +02:00
|
|
|
After the scoped key works, delete or lock down this bootstrap key.
|
