Operational Runbook #
Step-by-step procedures. The root of trust is held offline and run by its holder; the rest is in two halves written for two different readers.
Root of Trust
For the holder of the offline keys: generating the Deevnet Root CA and each site's CA on an offline machine, signing issuing CAs, and keeping the keys.
Substrate Operations
For the operator: building and recovering the platform, keeping it current, the network, and admitting tenants.
Tenant Operations
For whoever is building on Deevnet: getting a tenant, using each service, and running it day to day.
The split follows the architecture: the substrate is run by the operator through Ansible, and a tenant is run by its owner through Terraform against the Deevnet API. Nothing in the tenant half needs substrate credentials, and nothing in the substrate half creates tenant content.
How change and incidents are handled on either side is under Policies & Procedures.