Secrets: node-sealed custody for DNS-01 tokens (replaces J62's owner-only file) #289

New issue

Open

opened 2026-11-01 11:11:36 +00:00 by kayg · 0 comments

kayg commented

2026-11-01 11:11:36 +00:00

Owner

The reverse proxy (#281, job J62) needs DNS-01 provider tokens on the issuing node, and they must survive restarts. dev has no generic node-sealed secret store.

Interim (J62, slice 1): a DnsTokenCustody interface with one implementation, an owner-only file. The file sits in a 0700 directory under the infraternal agent's state dir and is created 0600; startup refuses if the mode or owner is wrong. Traefik gets a path through the provider's *_FILE variable. The token never appears in env or argv by value, in rendered config, or in logs.

Decision needed (owner): what replaces the interim store.

(a) Seal with the node key: an envelope over the existing node identity. This needs a crypto design review, and D-numbered foundation rules apply.
(b) Make OpenBao (#287) the backend for node secrets.
(c) Keep the owner-only files. This relies on the host's own protections, such as full-disk encryption.

Callers depend only on the interface, so swapping the implementation later does not change them.

The reverse proxy (#281, job J62) needs DNS-01 provider tokens on the issuing node, and they must survive restarts. dev has no generic node-sealed secret store. **Interim (J62, slice 1):** a `DnsTokenCustody` interface with one implementation, an owner-only file. The file sits in a 0700 directory under the infraternal agent's state dir and is created 0600; startup refuses if the mode or owner is wrong. Traefik gets a path through the provider's `*_FILE` variable. The token never appears in env or argv by value, in rendered config, or in logs. **Decision needed (owner):** what replaces the interim store. - (a) Seal with the node key: an envelope over the existing node identity. This needs a crypto design review, and D-numbered foundation rules apply. - (b) Make OpenBao (#287) the backend for node secrets. - (c) Keep the owner-only files. This relies on the host's own protections, such as full-disk encryption. Callers depend only on the interface, so swapping the implementation later does not change them.

kayg referenced this issue

2026-11-01 13:51:58 +00:00

Reverse proxy: Traefik on demand — implementation plan #281

kayg referenced this issue

2026-11-01 14:25:27 +00:00

Reverse proxy: Traefik on demand — implementation plan #281

kayg referenced this issue

2026-11-01 14:42:58 +00:00

Reverse proxy: Traefik on demand — implementation plan #281

kayg referenced this issue

2026-11-01 16:17:01 +00:00

Reverse proxy: Traefik on demand — implementation plan #281