coulomb/secrets-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
secrets-engine/docs/hardening-backlog.md

3.4 KiB
Raw Blame History

Hardening Backlog — Exit From Bootstrap Mode

The MVP runs in bootstrap mode: stage roles may be driven by temporary root-created OpenBao tokens read from mode-0600 files. That is acceptable setup material, not the steady state. This backlog tracks the work to retire it.

The MVP is honest about this: bootstrap mode is a documented, bounded phase with explicit revocation tasks — not a hidden permanent security posture.

H0 — Revoke outstanding bootstrap tokens (always-on hygiene)

Every minted bootstrap token has a revocation task. Track each here:

Token file Stage Minted TTL Revoked?
~/.secrets-engine/bootstrap/prod.token prod (n/a — demo uses dev server) 1h n/a
~/.secrets-engine/bootstrap/prod-warden-sign.token prod SECRETS-WP-0004 live lane applied via attended operator flow; file use not recorded in repo 1h cleanup/revocation evidence not recorded
~/.secrets-engine/bootstrap/prod-whynot-design.token prod pending SECRETS-WP-0003 live apply/provision 1h pending

Revoke: bao token revoke -accessor <accessor> then shred -u <file>. For SECRETS-WP-0004, the scoped warden-sign token used for the 2026-06-29 smoke had a 15m TTL; explicit accessor revocation and handoff-file cleanup are operator-side hygiene if any material remains. Do not record accessors or file contents in this repo.

H0a — Revoke pilot workload tokens

Credential Custody path Minted Revocation task Revoked?
whynot-design Gitea bot npm/package token OpenBao lane whynot-design-npm-publish, source handoff file ~/.secrets-engine/handoff/whynot-design-npm.token pending SECRETS-WP-0003 bot/token gate Revoke or rotate the bot token in Gitea, delete the source handoff file with shred -u, and record non-secret package/version evidence after publish pending

H1 — Replace bootstrap token files with OIDC / service auth

  • Stand up an OpenBao auth method (OIDC or AppRole bound to a workload identity) for each stage role.
  • secrets-engine logs in via that method instead of reading a token file.
  • Remove --bootstrap-token-file from the steady-state path (keep only for true break-glass, heavily audited).

H2 — Response-wrapped handoff

  • Add a wrapped delivery mode using OpenBao response wrapping for operator handoff flows where exec-time injection does not fit.

H3 — Production dual-control

  • Require two-person approval (approval.model: dual-control) for prod value provisioning before automating raw-value writes beyond the pilot.

H4 — Rotation & lifecycle states

  • Implement rotate, and explicit compromised / deactivated lane states with evidence, beyond the current revoke (metadata delete).

H5 — Audit report command

  • secrets-engine audit <catalog-id> summarizing non-secret evidence (decision, applies, provisions, verifications, execs, revokes) for a lane.

H6 — API service mode

  • Expose the stabilized CLI semantics as a local service API for ops-warden, CI, agents, and a future UI — after the CLI contract is proven.

Exit criteria for "bootstrap mode is over"

  • No steady-state flow reads a bootstrap token file.
  • Every stage role authenticates through OIDC/service auth.
  • Production provisioning beyond the pilot requires dual-control.
  • Rotation and deactivation are first-class, evidenced operations.