coulomb/resource-control
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

retarget: T04 backup key is resource-control, not Barman

Browse source 
Handle becomes secret:railiance-platform/backup. IAM application is
resource-control; policy and API key are Scoped backup access.
This commit is contained in:
tegwick 2026-08-14 19:19:56 +02:00
parent 3241bace3c
commit 644d5391bd
5 changed files with 27 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

34
workplans/RESOURCE-WP-0002-procure-postgres-backup-storage.md
View file

@ -220,7 +220,7 @@ noncurrent lifecycle applied, ACL owner-only. Inventory is
Operating facts live on
`reef:storage/substrate/object-stores/platform-audit-storage.yaml`.
Founder set a Scaleway billing alert (email). Scaleway has no
euro hard-stop; that gap is accepted. Scoped Barman key remains T04.
euro hard-stop; that gap is accepted. Scoped backup key remains T04.
## T04 — Establish credential custody and hand off to rapp-postgres
@ -231,27 +231,33 @@ priority: high
state_hub_task_id: "a2dc370a-b5e7-44b1-b46a-f3b84815b14a"
```
Route the scoped bucket credential to `railiance-platform` through the approved
OpenBao/credential-broker lane. Permit only the bucket/prefix operations CNPG
requires. Keep credential values out of Git, State Hub, shell history, logs,
and chat.
Route the scoped **backup** object-store credential to
`railiance-platform` through the approved OpenBao/credential-broker
lane. Principal is IAM application `resource-control`; API key and
policy are `Scoped backup access`. Permit only the project-scoped
object-store operations backup consumers need. Keep credential values
out of Git, State Hub, shell history, logs, and chat.
Hand the non-secret endpoint, bucket/prefix, region, CA/TLS requirements, and
retention parameters to `rapp-postgres`. Verify Barman's empty-WAL-archive check
before enabling continuous archiving.
Hand the non-secret endpoint, bucket/prefix, region, CA/TLS
requirements, and retention parameters to `rapp-postgres` as the first
consumer. Verify the empty-WAL-archive check before enabling continuous
archiving.
Done when credential delivery is renewable/revocable, a negative credential
cannot access the bucket, and `rapp-postgres` can perform the storage preflight
without disclosing a value.
Started 2026-08-14: bootstrap key cannot create IAM applications. Lane
prepared — `CCR-2026-0012` (proposed), policy file, mason plan
`platform-pg-backup-s3` (draft), founder put instructions, non-secret
destination handed at
retargeted the same day to a general backup identity — `CCR-2026-0012`
(proposed), mason plan `backup-object-storage` (draft), founder put
instructions, handle `secret:railiance-platform/backup`, first consumer
projection Secret `platform-pg-backup-s3`. Non-secret destination
handed at
`rapp-postgres/docs/handoff/RESOURCE-WP-0002-T04-barman-destination.md`.
Waiting on founder: approve the CCR, mint the project-scoped IAM
application and key, put values in OpenBao, say “the Barman key is in
bao.” Do not enable WAL yet.
Waiting on founder: approve the CCR, use IAM application
`resource-control`, bind policy and key `Scoped backup access`, put
values in OpenBao, say “the backup key is in bao.” Do not enable WAL
yet.
## T05 — Prove backup, full restore, and PITR

2
workplans/RESOURCE-WP-0006-resource-object-and-reef-refs.md
View file

@ -101,7 +101,7 @@ operational/credential refs or explicit gaps on every
`data/resources/` record. The proposed backup resource is the proving
case: consumers potential = `rapp-postgres`; actual = empty until WAL
flows; attribute refs wait on `reef-storage`; credential handle =
`secret:railiance-platform/platform-pg-backup-s3` once custody exists.
`secret:railiance-platform/backup` once custody exists.
Done when no live record relies on undifferentiated `workload_ids` as the
only consumer list.