Secrets and Identity #
Where the site’s secrets live and who may reach them: Ansible Vault, then OpenBao with its own keys from the vault; and identity for the people and services that use them.
✓ 5 |
↻ 0 |
⏳ 2
(7 total)
Legend: ✅ Complete | 🔄 In Progress | ⏳ Planned
Value objectives: Rebuild from code, One part-time operator can run it, Secure by default
- ✅ The site’s infrastructure secrets in Ansible Vault, guarded on every commit 2026-03-14
- ✅ OpenBao secrets manager deployed; the Deevnet API reads its credentials from it (CHG-0010) 2026-09-17
- ✅ Builds take their secrets from OpenBao, none on disk (CHG-0026) 2026-09-25
- ✅ OpenBao’s keys made outside it and loaded from the site’s vault on every build, its access restricted and audited (CHG-0036) 2026-10-25
- ✅ OpenBao sealed by split-key (Shamir) shares, opened only for a work session (CHG-0053) 2026-11-08
- ⏳ OpenBao rebuilt from the site’s vault alone in a drill, nothing restored (ADR-0042 V12)
- ⏳ Single sign-on and role-based access for infrastructure services
Project plan: Secrets and Identity