Backups: exercise + escrow the disaster-recovery age key

supernaut kommenterad

2026-07-19 21:51:33 +00:00

Ägare

Split from #126 (backup-robustness umbrella). The bug-class items (M6/M7/L2/L3) shipped in PR #147; this is one of the remaining design items.

Severity: HIGH — area/backups.

The DR-key decryption path is never exercised or escrowed

The restore drill (backup-drill/bitborg-backup-drill.py.j2) and the weekly verify (bitborg-backup-verify.sh.j2) both decrypt with the on-host verify age key. The real disaster-recovery key (backup_age_recipient, group_vars/all/vars.yml) lives only in 1Password — nothing ever proves an archive actually decrypts with the DR key, and it is a single-vault SPOF.

Ask

Periodic manual DR-key restore test: decrypt a real off-site archive with the offline DR identity and restore it.
Store a second sealed copy of the DR identity independent of 1Password (offline escrow).

Refs #126.

> Split from #126 (backup-robustness umbrella). The bug-class items (M6/M7/L2/L3) shipped in PR #147; this is one of the remaining design items. **Severity: HIGH** — `area/backups`. ## The DR-key decryption path is never exercised or escrowed The restore drill (`backup-drill/bitborg-backup-drill.py.j2`) and the weekly verify (`bitborg-backup-verify.sh.j2`) both decrypt with the on-host **verify** age key. The real disaster-recovery key (`backup_age_recipient`, `group_vars/all/vars.yml`) lives **only in 1Password** — nothing ever proves an archive actually decrypts with the DR key, and it is a single-vault SPOF. ### Ask - Periodic **manual DR-key restore test**: decrypt a real off-site archive with the offline DR identity and restore it. - Store a **second sealed copy** of the DR identity independent of 1Password (offline escrow). Refs #126.

supernaut lade till etiketterna

2026-07-19 21:51:34 +00:00

supernaut refererade till detta ärende

2026-07-19 21:52:17 +00:00

Backup robustness for production (DR key drill, RPO/PITR, hot-skew, partial leak, off-site failure, RTO) #126

supernaut lade till detta till projektet Bitborg Infrastructure

2026-07-19 21:52:20 +00:00

supernaut lade till

ready-for-implementation

och tog bort

needs-triage

etiketter

2026-07-30 22:33:39 +00:00

supernaut refererade till detta ärende

2026-09-08 23:04:25 +00:00

backup-drill: restore and verify Kanidm on the scratch VM #458

supernaut refererade till detta ärende

2026-09-08 23:04:28 +00:00

operations: second-operator onboarding and escrow of the vault password and state passphrase #468

supernaut refererade till detta ärende från bitborg/bitborg-docs

2026-09-24 13:04:40 +00:00

Data safety: recovery that has been proven, not assumed #107

supernaut kommenterad

2026-09-24 13:04:56 +00:00

Upphovsperson

Ägare

Epic: bitborg/bitborg-docs#107

supernaut kommenterad

2026-09-30 10:55:30 +00:00

Upphovsperson

Ägare

Status 2026-09-30: an operator walkthrough for the exercise (fetch one off-site archive, decrypt with the DR identity, verify contents, wipe) and for escrow (paper copy, text plus QR, in a physical safe) is written and tracked internally. Remaining here: the operator runs the exercise and records date, archive name and pass or fail in this issue, then the runbook gets a DR-key subsection with the cadence and the escrow location.

Rader
Kolumner

Backups: exercise + escrow the disaster-recovery age key #157

The DR-key decryption path is never exercised or escrowed

Ask