admin/felhom.eu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(report): STOP-3 DONE; STOP-2 still pending (offsite re-issue was pressed, not PBS-DR)

Browse Source
This commit is contained in:
authentik Default Admin
2026-07-21 10:36:52 +02:00
parent 4da74700c9
commit 33116a547e
1 changed files with 20 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
REPORT.md
+20 -1
View File
@@ -14,8 +14,27 @@ STOP-1 evidence and the four red-proofs).
|---|---|
| Hub v0.68.0 | **SHIPPED + DEPLOYED** — GitOps manifest bump `0.67.0→0.68.0`, ArgoCD `Synced/Healthy`, rollout complete, pod 1/1 |
| Agent v0.91.2 | shipped + published + deployed to felhom-pve |
| Hub v0.68.1 | **SHIPPED + DEPLOYED** — fixes the Configuration layout the v0.68.0 field broke |
| STOP-1 | done + verified |
| **STOP-2 / STOP-3** | **BLOCKED — need the operator.** I cannot authenticate to the hub UI (login → HTTP 401); the password is a bcrypt hash I do not hold, by design. |
| **STOP-3 — manifest save** | **DONE by the operator 2026-07-21 08:31:12Z.** All six fields persisted, including `artifact_wrapper_sha256 = 104db0a4…` (matches the agent's reported hash → drift gauge reads **ok**) and `artifact_min_agent = 0.91.2`. |
| **STOP-2 — live re-issue** | **NOT DONE — the wrong Re-issue was pressed.** The hub recorded `offsite_reissued` (the restic/Hetzner offsite credential), not the PBS-DR one. Evidence: `host_pbs_secrets` is untouched (created + consumed 2026-07-18, `generation = 0`) and the `pbs_dr` descriptor still carries **no** `secret_generation` key. See §STOP-2 below. |
## STOP-2 — what actually happened, and the side effect
The button pressed was the **offsite** re-issue, not **PBS DR**. Hub events at 08:29:29Z:
`offsite_reissued` followed immediately by `escrow_stale`
("A helyreállítási kulcs-letét elavult az offsite jelszó cseréje miatt").
**Consequence that needs an action:** rotating the offsite restic password makes the escrow blob seal
a password that no longer opens the repo, so the hub correctly stops advertising "ceremony done"
(the designed v0.57.0 `stale_at` behaviour — not a bug, but a real follow-up). **The recovery-code
ceremony has to be re-run** before the offsite leg is trustworthy again.
**PBS-DR is untouched and healthy** — a live probe with the stored credential still returns 200 and
the secret file's mtime is unchanged (2026-07-18 20:28:52), which is exactly consistent with "no PBS
re-key happened".
The R-39 proof therefore still needs the **PBS DR** re-issue specifically.
## What shipped hub-side