5.6 KiB
Break-glass sheet — the keys that must exist outside DooPlex (R-923, D32)
A template. It holds NO key value, and none may ever be written into this file, a commit, a log or a chat. Print this page, then write or stick each value onto the paper copy only. Keep the paper away from home (DooPlex is at home: a fire takes both). Why each key is here and what it opens:
total-loss-of-dooplex.md.A key in the password manager is not enough: Vaultwarden runs on DooPlex (operator ruling, 2026-10-09).
How to print a key without it landing anywhere
Run these from your own workstation (not through Claude Code, not through !). Each command writes one file on
the workstation; open it, print it, then destroy the file. Nothing is stored on DooPlex or in any log.
D=kisfenyo@192.168.0.180 # DooPlex
# S1 and S2 — PBS keys: Proxmox's own paper form (text + QR code)
ssh -t $D 'sudo proxmox-backup-client key paperkey /etc/felhom-dooplex-offsite/enc.key --output-format html --subject "S1 DooPlex off-site key"' > s1.html
ssh -t $D 'sudo proxmox-backup-client key paperkey /etc/felhom-hub-backup/enc.key --output-format html --subject "S2 Hub-DB off-site key"' > s2.html
# S4, S5, S7 — one line each
ssh -t $D 'sudo kubectl -n felhom-system get secret offsite-secret-key -o jsonpath="{.data.OFFSITE_SECRET_KEY}" | base64 -d' > s4.txt
ssh -t $D 'sudo cat /etc/backup/restic-password' > s5.txt
ssh -t $D 'sudo cat /etc/felhom-hub-backup/token-restore' > s7.txt
# S6 — the signing keys (OpenSSH text, ~7 lines each)
ssh $D 'cat /mnt/5_hdd/felhom.eu/felhom-rec-recovery' > s6-recovery.txt
ssh $D 'cat /mnt/5_hdd/felhom.eu/felhom-op-operational' > s6-operational.txt
# open each, print, check the print is readable, then:
shred -u s1.html s2.html s4.txt s5.txt s7.txt s6-recovery.txt s6-operational.txt
On Windows without shred: delete the files and empty the recycle bin. The -t adds a carriage return to the
captured line on some systems; strip it when typing the value back.
Check a print later without exposing it: for S1/S2 the only reliable check is one restore with a key file rebuilt
from the printed data field (hub-DB runbook Step 0 note) — key show cannot check a rebuilt key.
Public fingerprints — to check you hold the right key (not secret; not on the printed page)
| # | Fingerprint |
|---|---|
| S1 | PBS key 93:03:bf:d7:1f:4c:9e:fe… (proxmox-backup-client key show) |
| S2 | PBS key b2:19:bf:36:3b:97:3d:6c… |
| S6a | SHA256:/ixgTesZqykAGJpFUUd4kLAiHFgKOkYFLNC3AQXWP+k |
| S6b | SHA256:7YqN4rXO08yixTeOO+UtQ8jHyIGycICuctQgRYVGnWw |
| S19 | recipient age1aw83ej37x9sck89xwt856ry0553kf5sng3w544an4et54yjdx5qq79utrv |
Every place below was checked to exist on 2026-10-23 (existence only, no value read). The release copy on ep0 (D33) and the 6-hourly hub-DB copy (D34) add NO key: the release copy is not encrypted (it holds no secret), and the hub-DB copy uses S2 as before.
The sheet (print from here — one A4 page)
FELHOM — vészhelyzeti kulcsok / break-glass keys. Nyomtatva / printed: ____________ Hol tárolom / kept at: ______________________
Csak nevek és helyek; az értéket kézzel írd be. Names and places only; write each value by hand. Tartsd az otthonon kívül. Keep it outside the home.
| # | Név / Name | Hol van most / Where it lives now | Érték / Value |
|---|---|---|---|
| S1 | DooPlex off-site kulcs / DooPlex off-site key (Gitea, jelszókezelő / password manager, k8s Secrets) | DooPlex /etc/felhom-dooplex-offsite/enc.key |
data: ____________________________ |
| S2 | Hub-adatbázis off-site kulcs / Hub-DB off-site key | DooPlex /etc/felhom-hub-backup/enc.key |
data: ____________________________ |
| S4 | Hub pecsétkulcs / hub seal key OFFSITE_SECRET_KEY |
k8s Secret felhom-system/offsite-secret-key |
__________________________________ |
| S5 | DooPlex restic / Secrets-export jelmondat / passphrase | DooPlex /etc/backup/restic-password |
__________________________________ |
| S6a | Aláíró HELYREÁLLÍTÓ kulcs / signing RECOVERY key | DooPlex /mnt/5_hdd/felhom.eu/felhom-rec-recovery |
(tűzd ide / staple) |
| S6b | Aláíró ÜZEMI kulcs / signing OPERATIONAL key | DooPlex /mnt/5_hdd/felhom.eu/felhom-op-operational |
(tűzd ide / staple) |
| S7 | ep0 csak-olvasó token / read-only token dooplex-hub@pbs!restore |
DooPlex /etc/felhom-hub-backup/token-restore |
__________________________________ |
| S8 | Hetzner fiók / account (e-mail · jelszó / password · 2FA kódok / codes) | Vaultwarden | __________________________________ |
| S11 | Cloudflare fiók / account (login · jelszó / password · 2FA kódok / codes) | Vaultwarden | __________________________________ |
| S12 | Gmail felhom.eu@gmail.com (jelszó / password · 2FA kódok / codes) |
Vaultwarden | __________________________________ |
| S19 | CC secrets age kulcs / key (admin/cc-secrets) |
DooPlex ~/.config/sops/age/keys.txt; Vaultwarden |
AGE-SECRET-KEY-1__________________ |
| S3 | Vaultwarden mesterjelszó / master password | a fejedben / in your head | (csak ha akarod / only if you choose) |
Nem titok, de kell / not secret, needed: ep0 = 167.233.158.164 (Hetzner, felhom-hetzner), PBS felhom-offsite, névtér / namespace operator; tanúsítvány / certificate
c6:07:28:3f:5b:7b:5a:41:90:28:d7:ca:4f:37:14:70:56:39:2e:2f:0b:71:e8:06:ca:60:4a:d5:56:5f:3c:fd. Kiadások másolata / release copy: ep0 /srv/felhom-release-copy/data.
Sorrend / order: total-loss-of-dooplex.md — nyomtasd ki azt is / print it too. Újranyomtatás / re-print: kulcscserekor és évente / when a key rotates, and yearly.