prole/docs/PROLE-CFG-SECRETS.md

57 lines
2.4 KiB
Markdown
Raw Permalink Blame History

This file contains ambiguous Unicode characters

This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

# knoe.cfg Secrets
This document describes how secrets are handled in `knoe.cfg` and where they are stored.
## External secret store: 1Password (`knoey` vault)
The master database password (`administrator`) is stored in a dedicated 1Password vault called **`knoey`**, isolated from the user's personal vaults.
| 1Password item | Field | Purpose |
|---|---|---|
| `administrator` | `password` | Database master password (formerly in Ansible vault) |
| `k3s-token` | `credential` | k3s cluster join token |
| `samba-dns-admin` | `password` | Samba/AD DNS admin password |
`install.sh` creates the `knoey` vault and the `administrator` item on first run (via `etc/init_1password.sh`). The `op` CLI (`brew install 1password-cli`) is required.
## Temporary encrypted values
During installation, secrets are written to `knoe.cfg` as temporary encrypted values so an interrupted run can resume:
- Format: `${KNOE_SECRET:v1:<nonce_b64>:<ciphertext_b64>}`
- Encryption: AES256GCM
- Key storage:
- macOS: login Keychain (service `knoe-installer`)
- Other platforms: `~/.knoe/secrets/installer.key` (0600)
These encrypted values are removed at PostInstall by running `etc/build-a-bao.sh`.
## OpenBao placeholders
After PostInstall, secrets in `knoe.cfg` are replaced with OpenBao placeholders that point to a namespacescoped KV path:
- Format: `${OPENBAO:kv/knoe/<namespace>/<leaf>#<key>}`
The namespace comes from `NAMESPACE` in `knoe.cfg` and makes the file 1:1 with a single `knoe-db` deployment.
## Secrets recorded in knoe.cfg
The following keys are treated as secrets and stored in OpenBao:
| knoe.cfg key | OpenBao KV path |
| --- | --- |
| `Inputs.init_password.db_password` | `kv/knoe/<namespace>/db#password` |
| `Inputs.init_password.db_password_confirm` | `kv/knoe/<namespace>/db#password` |
| `Global.DB_PASSWORD` | `kv/knoe/<namespace>/db#password` |
| `Inputs.kerberos_config.password` | `kv/knoe/<namespace>/kerberos#password` |
| `Kerberos Authentication.PASSWORD` | `kv/knoe/<namespace>/kerberos#password` |
| `Monitoring.GRAFANA_ADMIN_PASSWORD` | `kv/knoe/<namespace>/monitoring#grafana_admin_password` |
## PostInstall step
Run the BuildABao step on the PostInstall screen (or `etc/build-a-bao.sh`) to:
1) Decrypt temporary secrets from `knoe.cfg`
2) Write them to OpenBao under the namespace path
3) Replace `knoe.cfg` secrets with OpenBao placeholders