mirror of
https://github.com/dredx/prole.git
synced 2026-09-23 11:03:59 +00:00
57 lines
2.4 KiB
Markdown
57 lines
2.4 KiB
Markdown
# knoe.cfg Secrets
|
||
|
||
This document describes how secrets are handled in `knoe.cfg` and where they are stored.
|
||
|
||
## External secret store: 1Password (`knoey` vault)
|
||
|
||
The master database password (`administrator`) is stored in a dedicated 1Password vault called **`knoey`**, isolated from the user's personal vaults.
|
||
|
||
| 1Password item | Field | Purpose |
|
||
|---|---|---|
|
||
| `administrator` | `password` | Database master password (formerly in Ansible vault) |
|
||
| `k3s-token` | `credential` | k3s cluster join token |
|
||
| `samba-dns-admin` | `password` | Samba/AD DNS admin password |
|
||
|
||
`install.sh` creates the `knoey` vault and the `administrator` item on first run (via `etc/init_1password.sh`). The `op` CLI (`brew install 1password-cli`) is required.
|
||
|
||
## Temporary encrypted values
|
||
|
||
During installation, secrets are written to `knoe.cfg` as temporary encrypted values so an interrupted run can resume:
|
||
|
||
- Format: `${KNOE_SECRET:v1:<nonce_b64>:<ciphertext_b64>}`
|
||
- Encryption: AES‑256‑GCM
|
||
- Key storage:
|
||
- macOS: login Keychain (service `knoe-installer`)
|
||
- Other platforms: `~/.knoe/secrets/installer.key` (0600)
|
||
|
||
These encrypted values are removed at Post‑Install by running `etc/build-a-bao.sh`.
|
||
|
||
## OpenBao placeholders
|
||
|
||
After Post‑Install, secrets in `knoe.cfg` are replaced with OpenBao placeholders that point to a namespace‑scoped KV path:
|
||
|
||
- Format: `${OPENBAO:kv/knoe/<namespace>/<leaf>#<key>}`
|
||
|
||
The namespace comes from `NAMESPACE` in `knoe.cfg` and makes the file 1:1 with a single `knoe-db` deployment.
|
||
|
||
## Secrets recorded in knoe.cfg
|
||
|
||
The following keys are treated as secrets and stored in OpenBao:
|
||
|
||
| knoe.cfg key | OpenBao KV path |
|
||
| --- | --- |
|
||
| `Inputs.init_password.db_password` | `kv/knoe/<namespace>/db#password` |
|
||
| `Inputs.init_password.db_password_confirm` | `kv/knoe/<namespace>/db#password` |
|
||
| `Global.DB_PASSWORD` | `kv/knoe/<namespace>/db#password` |
|
||
| `Inputs.kerberos_config.password` | `kv/knoe/<namespace>/kerberos#password` |
|
||
| `Kerberos Authentication.PASSWORD` | `kv/knoe/<namespace>/kerberos#password` |
|
||
| `Monitoring.GRAFANA_ADMIN_PASSWORD` | `kv/knoe/<namespace>/monitoring#grafana_admin_password` |
|
||
|
||
## Post‑Install step
|
||
|
||
Run the Build‑A‑Bao step on the Post‑Install screen (or `etc/build-a-bao.sh`) to:
|
||
|
||
1) Decrypt temporary secrets from `knoe.cfg`
|
||
2) Write them to OpenBao under the namespace path
|
||
3) Replace `knoe.cfg` secrets with OpenBao placeholders
|