hackclub/burrow
Watch
1
0
Fork
You've already forked burrow
 0
Code Pull requests 1 Releases 18 Packages Activity Actions

Initialize OpenBao with approved recovery custody and declarative audit #10

Open
contact wants to merge 0 commits from codex/openbao-recovery-custody into main
pull from: codex/openbao-recovery-custody
merge into: hackclub:main
Conversation 0 Commits - Files changed -
contact commented 2026-09-27 02:27:56 -07:00
Owner
Copy link

OpenBao could not be initialized until recovery recipients were approved. Conrad explicitly approved the existing operator/contact SSH recipient and forge-host age recipient. This change stores only ciphertext for the WIF bootstrap credential, initialization bundle and initial stopped-storage backup, and derives routine WIF custody through agenix.

The live vault is now initialized and auto-unsealed. Its HMAC audit device is declarative because OpenBao 2.6 rejects API-created audit devices. Deployment also exposed upstream restartIfChanged=false: the module now forces restart and disables reload so new seal/audit settings actually reach the running process.

Validation: four initialization boundary tests; Nix configuration assertions and full NixOS builds; successful operator and host decryption without plaintext output; live restart/automatic unseal; encrypted stopped-storage backup restored to an isolated loopback vault, with sentinel and exact dispatcher/telemetry policies verified. No runtime auth roles were granted. The final generation is 0dn5cglnpm3vzph8if643xxvqdlm5633, with rollback retained at pre-openbao-restart-policy-20260927.

Recovery is single-operator (one share, threshold one), encrypted to two approved custodians; it is not a multi-person quorum. The initial root token remains in encrypted bootstrap custody pending verified admin login and revocation. Consumer migration, admin login, vault DNS and scheduled backup operations remain separate gates. BEP-0025 and the runbook record these limits. No plaintext tokens, keys or recovery shares are committed.

OpenBao could not be initialized until recovery recipients were approved. Conrad explicitly approved the existing operator/contact SSH recipient and forge-host age recipient. This change stores only ciphertext for the WIF bootstrap credential, initialization bundle and initial stopped-storage backup, and derives routine WIF custody through agenix. The live vault is now initialized and auto-unsealed. Its HMAC audit device is declarative because OpenBao 2.6 rejects API-created audit devices. Deployment also exposed upstream restartIfChanged=false: the module now forces restart and disables reload so new seal/audit settings actually reach the running process. Validation: four initialization boundary tests; Nix configuration assertions and full NixOS builds; successful operator and host decryption without plaintext output; live restart/automatic unseal; encrypted stopped-storage backup restored to an isolated loopback vault, with sentinel and exact dispatcher/telemetry policies verified. No runtime auth roles were granted. The final generation is 0dn5cglnpm3vzph8if643xxvqdlm5633, with rollback retained at pre-openbao-restart-policy-20260927. Recovery is single-operator (one share, threshold one), encrypted to two approved custodians; it is not a multi-person quorum. The initial root token remains in encrypted bootstrap custody pending verified admin login and revocation. Consumer migration, admin login, vault DNS and scheduled backup operations remain separate gates. BEP-0025 and the runbook record these limits. No plaintext tokens, keys or recovery shares are committed.
Initialize OpenBao with approved encrypted recovery custody and audit
All checks were successful
Build Rust / Cargo Test (pull_request) Successful in 7m23s
Details
Build Site / Next.js Build (pull_request) Successful in 29s
Details
Lint Governance / BEP Metadata (pull_request) Successful in 38s
Details
24191388cf
All checks were successful
Build Rust / Cargo Test (pull_request) Successful in 7m23s
Details
Build Site / Next.js Build (pull_request) Successful in 29s
Details
Lint Governance / BEP Metadata (pull_request) Successful in 38s
Details
This branch is already included in the target branch. There is nothing to merge.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin codex/openbao-recovery-custody:codex/openbao-recovery-custody
git switch codex/openbao-recovery-custody
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
hackclub/burrow!10
No description provided.