admin/felhom.eu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: offsite hardening bundle — hub README, REPORT, CONTEXT

Browse Source 
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6
This commit is contained in:
authentik Default Admin
2026-07-09 22:48:41 +02:00
parent 17d9af5c13
commit e0d1733b85
3 changed files with 46 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hub/README.md
+11 -3
View File
@@ -79,9 +79,17 @@ the controller re-pulls. The controller consumes the one-time password at `POST
(customer-API-key auth, single-use) — then installs its key and the hub resets the box password (SLICE 2+).
**Fail-closed:** a provisioning error returns 502 and saves nothing. **Secrets:** the Hetzner token
(`HETZNER_TOKEN`, out-of-band) and every generated password are NEVER logged / committed / in `ConfigJSON`.
**PREREQUISITE for live use:** the token MUST be scoped to a **dedicated Hetzner project** (the current shared
project token can delete ep0 — spike §6). Absent token → the UI still renders; saving with offsite enabled
returns "not configured". SLICE 2 (controller apply-bridge), SLICE 3 (escrow auto-confirm), SLICE 4 (soft-quota) follow.
**PREREQUISITE for live use:** the token MUST be scoped to a **dedicated Hetzner project** (the shared
project token can delete ep0 — spike §6); check the scope by listing boxes with it. Absent token → the UI
still renders; saving with offsite enabled returns "not configured". **Live-validated end-to-end 2026-07-09**
(`documentation/audits/VALIDATION-offsite-provisioning-e2e-2026-07-09.md`): SLICE 2 (controller apply-bridge)
is shipped and applied.
**Hardening (v0.38.1–v0.39.0):** provisioning runs on a client-disconnect-proof detached context (F1); the
host-key scan retries through fresh-subaccount DNS lag (~60s ladder, F2); the save button disables with an
in-flight notice (F5); and **"Re-issue offsite credentials"** (F4, `POST /configs/{id}/offsite-reissue`) is
the explicit recovery for a consumed-password dead-end — resets ONLY the resource labelled for that customer
(refuses unless exactly 1), stores a fresh one-time secret, bumps `ConfigVersion`. Never implicit rotation.
SLICE 3 (escrow auto-confirm) and SLICE 4 (soft-quota) follow.
### Infrastructure Backup — RETIRED (Phase-1, 2026-06-16, hub v0.12.0)