S25: HSM custody, sync.pfc, georgelambert.org/pfc deep links
Some checks are pending
review / inventory (push) Waiting to run
Some checks are pending
review / inventory (push) Waiting to run
UserReview leftovers implemented without rewriting 70 website repos and without fail-closing pfc-py-admin.
This commit is contained in:
parent
8c09abecae
commit
aa7c837493
9 changed files with 171 additions and 11 deletions
44
docs/HSM-CUSTODY.md
Normal file
44
docs/HSM-CUSTODY.md
Normal file
|
|
@ -0,0 +1,44 @@
|
|||
# HSM / key custody
|
||||
|
||||
This is **not** a HIPAA/SOC 2/ISO certificate.
|
||||
|
||||
## What lives where
|
||||
|
||||
| Key | Lab (ns1) | Production |
|
||||
|---|---|---|
|
||||
| Config Ed25519 | `/opt/pfc/etc/sm-keys/config.ed25519.pem` mode 0600 root | Customer HSM / PKCS#11; public half in signed wrapper `sig.key_id` |
|
||||
| NPE HPKE | `/opt/pfc/etc/npe/lab.seed` + `lab.npeid` (host only) | `npe keygen --rotate --id` on HSM-backed seed; inbox id unchanged |
|
||||
| System bounce | `crypto.system_key_id` in signed payload | Same id; private material in HSM |
|
||||
| Session / Google | `/opt/pfc/etc/admin.env` | Secrets manager; never git |
|
||||
|
||||
Private files are **never** committed. Public PEMs and `.npeid` may be copied.
|
||||
|
||||
## Rotate config signing key (lab)
|
||||
|
||||
```bash
|
||||
sudo python3 /opt/pfc/python/secure_messaging/../scripts/rotate_config_key.py
|
||||
# or from the repo:
|
||||
sudo python3 scripts/rotate_config_key.py \
|
||||
--pem /opt/pfc/etc/sm-keys/config.ed25519.pem \
|
||||
--signed /opt/pfc/etc/secure-messaging.signed.json \
|
||||
--history /opt/pfc/data/admin/admin-history \
|
||||
--actor rotate-lab
|
||||
```
|
||||
|
||||
Writes a **new** PKCS8 PEM, re-signs the current payload, appends prev+new+diff
|
||||
to the admin-history cube. Old PEM is kept as `config.ed25519.pem.prev`.
|
||||
|
||||
## Rotate NPE encryption key (lab)
|
||||
|
||||
```bash
|
||||
sudo /opt/pfc/bin/npe keygen --rotate --id /opt/pfc/etc/npe/lab.seed
|
||||
```
|
||||
|
||||
Inbox (`npe.inbox.<fp>`) stays stable. Previous enc keys are retained for
|
||||
`--keep-old` then `npe keygen --wipe-old --id ...`.
|
||||
|
||||
## Production HSM (not on ns1)
|
||||
|
||||
Guess until hardware is attached: PKCS#11 slot for Ed25519 config signatures;
|
||||
NPE seed never leaves the module. `PFC_CONFIG_KEY_PEM` is replaced by
|
||||
`PFC_CONFIG_KEY_PKCS11=pkcs11:token=...`. Unsigned wrappers still rejected.
|
||||
|
|
@ -7,16 +7,30 @@
|
|||
<body>
|
||||
<h1>system-git-sync</h1>
|
||||
<p>Hub for signed config, NATS naming, and ns1 deploy review. Not a HIPAA/SOC 2/ISO certificate.</p>
|
||||
<h2>This hub</h2>
|
||||
<ul>
|
||||
<li><a href="Historical-Information.MD">Historical-Information.MD</a> (read this after a context reset)</li>
|
||||
<li><a href="Historical-Information.MD">Historical-Information.MD</a></li>
|
||||
<li><a href="Remaining-Work.MD">Remaining-Work.MD</a></li>
|
||||
<li><a href="System-Git-Sync.MD">System-Git-Sync.MD</a></li>
|
||||
<li><a href="TODO.md">TODO.md</a></li>
|
||||
<li><a href="TODO-With-User.MD">TODO-With-User.MD</a></li>
|
||||
<li><a href="UserReview.MD">UserReview.MD</a></li>
|
||||
<li><a href="INVENTORY.md">INVENTORY.md</a></li>
|
||||
<li><a href="VARIABLES.md">VARIABLES.md</a></li>
|
||||
<li><a href="HSM-CUSTODY.md">HSM-CUSTODY.md</a></li>
|
||||
<li><a href="thesaurus.md">thesaurus.md</a></li>
|
||||
<li><a href="/nats-service-endpoints/index.html">NATS-Service-Endpoints catalog</a></li>
|
||||
<li><a href="links.html">Deep links (all public URLs)</a></li>
|
||||
</ul>
|
||||
<h2>Live ns1</h2>
|
||||
<ul>
|
||||
<li><a href="https://pfc.georgelambert.org/">PFC console</a> · <a href="https://pfc.georgelambert.org/health">/health</a> · <a href="https://pfc.georgelambert.org/v1/npe">/v1/npe</a></li>
|
||||
<li><a href="https://config.pfc.georgelambert.org/">config SPA</a></li>
|
||||
<li><a href="https://docs.pfc.georgelambert.org/">system docs</a> · <a href="https://docs.pfc.georgelambert.org/walkthrough.html">walkthrough</a></li>
|
||||
<li><a href="https://docs.pfc.georgelambert.org/nats-service-endpoints/">NATS-Service-Endpoints</a></li>
|
||||
<li><a href="https://docs.pfc.georgelambert.org/secure-messaging/">secure-messaging module</a></li>
|
||||
<li><a href="https://sync.pfc.georgelambert.org/">sync.pfc hub</a></li>
|
||||
<li><a href="https://georgelambert.org/pfc/">georgelambert.org/pfc deep links</a></li>
|
||||
<li><a href="https://git.georgelambert.org/marchon/system-git-sync">git.georgelambert.org/marchon/system-git-sync</a></li>
|
||||
</ul>
|
||||
<p>Git: <a href="https://git.georgelambert.org/marchon/system-git-sync">git.georgelambert.org/marchon/system-git-sync</a></p>
|
||||
</body>
|
||||
</html>
|
||||
|
|
|
|||
39
docs/links.html
Normal file
39
docs/links.html
Normal file
|
|
@ -0,0 +1,39 @@
|
|||
<!DOCTYPE html>
|
||||
<html lang="en">
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<title>PFC deep links</title>
|
||||
</head>
|
||||
<body>
|
||||
<h1>Deep links</h1>
|
||||
<p>Canonical public URLs. Not a HIPAA/SOC 2/ISO certificate. NATS is the untrusted broker; production E2E is NPE/HPKE; passthrough means dest in the clear.</p>
|
||||
<h2>Console and config</h2>
|
||||
<ul>
|
||||
<li><a href="https://pfc.georgelambert.org/">https://pfc.georgelambert.org/</a></li>
|
||||
<li><a href="https://pfc.georgelambert.org/health">https://pfc.georgelambert.org/health</a></li>
|
||||
<li><a href="https://pfc.georgelambert.org/v1/npe">https://pfc.georgelambert.org/v1/npe</a></li>
|
||||
<li><a href="https://config.pfc.georgelambert.org/">https://config.pfc.georgelambert.org/</a></li>
|
||||
</ul>
|
||||
<h2>Documentation</h2>
|
||||
<ul>
|
||||
<li><a href="https://docs.pfc.georgelambert.org/">https://docs.pfc.georgelambert.org/</a></li>
|
||||
<li><a href="https://docs.pfc.georgelambert.org/walkthrough.html">walkthrough + screenshots</a></li>
|
||||
<li><a href="https://docs.pfc.georgelambert.org/console.html">console</a></li>
|
||||
<li><a href="https://docs.pfc.georgelambert.org/nats.html">NATS</a></li>
|
||||
<li><a href="https://docs.pfc.georgelambert.org/nats-service-endpoints/">endpoint catalog</a></li>
|
||||
<li><a href="https://docs.pfc.georgelambert.org/secure-messaging/">secure-messaging</a></li>
|
||||
<li><a href="https://docs.pfc.georgelambert.org/sync/">docs.pfc /sync/</a></li>
|
||||
<li><a href="https://sync.pfc.georgelambert.org/">https://sync.pfc.georgelambert.org/</a></li>
|
||||
<li><a href="https://georgelambert.org/pfc/">https://georgelambert.org/pfc/</a></li>
|
||||
</ul>
|
||||
<h2>Git</h2>
|
||||
<ul>
|
||||
<li><a href="https://git.georgelambert.org/marchon/system-git-sync">system-git-sync</a></li>
|
||||
<li><a href="https://git.georgelambert.org/marchon/nats-service-endpoints">nats-service-endpoints</a></li>
|
||||
<li><a href="https://git.georgelambert.org/marchon/secure-messaging">secure-messaging</a></li>
|
||||
<li><a href="https://git.georgelambert.org/marchon/peergos-for-compliance">peergos-for-compliance</a></li>
|
||||
<li><a href="https://git.georgelambert.org/marchon/peergos-for-compliance-admin">peergos-for-compliance-admin</a></li>
|
||||
<li><a href="https://git.georgelambert.org/marchon/peergos-compliance-docs">peergos-compliance-docs</a></li>
|
||||
</ul>
|
||||
</body>
|
||||
</html>
|
||||
23
docs/pfc-site/index.html
Normal file
23
docs/pfc-site/index.html
Normal file
|
|
@ -0,0 +1,23 @@
|
|||
<!DOCTYPE html>
|
||||
<html lang="en">
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<title>Peergos for Compliance</title>
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1">
|
||||
</head>
|
||||
<body>
|
||||
<h1>Peergos for Compliance</h1>
|
||||
<p>Public deep links for the DataCube / NATS / NPE control plane on ns1.
|
||||
This is not a HIPAA/SOC 2/ISO certificate. Console login is separate from Peergos Drive.</p>
|
||||
<ul>
|
||||
<li><a href="https://pfc.georgelambert.org/">PFC console</a></li>
|
||||
<li><a href="https://config.pfc.georgelambert.org/">Signed-config preview SPA</a> (load still requires an Ed25519 wrapper)</li>
|
||||
<li><a href="https://docs.pfc.georgelambert.org/">Documentation (HTML)</a></li>
|
||||
<li><a href="https://docs.pfc.georgelambert.org/walkthrough.html">Operator walkthrough + screenshots</a></li>
|
||||
<li><a href="https://docs.pfc.georgelambert.org/nats-service-endpoints/">NATS service endpoints</a></li>
|
||||
<li><a href="https://sync.pfc.georgelambert.org/">system-git-sync hub</a></li>
|
||||
<li><a href="https://peergos.georgelambert.org/">Peergos Drive</a></li>
|
||||
<li><a href="https://git.georgelambert.org/marchon">git.georgelambert.org/marchon</a></li>
|
||||
</ul>
|
||||
</body>
|
||||
</html>
|
||||
Loading…
Add table
Add a link
Reference in a new issue