marchon/system-git-sync
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1
system-git-sync/UserReview.MD
George Lambert aa7c837493
Some checks are pending
review / inventory (push) Waiting to run
Details
S25: HSM custody, sync.pfc, georgelambert.org/pfc deep links 
UserReview leftovers implemented without rewriting 70 website repos
and without fail-closing pfc-py-admin.
2026-09-15 23:19:44 -04:00

1.1 KiB
Raw Blame History

UserReview

Decisions to confirm later. Work continued with guesses in TODO-With-User.MD.

  1. System public key custody — lab implemented. Ed25519 on host /opt/pfc/etc/sm-keys/ (0600). Rotate: scripts/rotate_config_key.py (re-sign + admin-history). NPE: npe keygen --rotate. Production HSM/PKCS#11 still hardware-not-present (docs/HSM-CUSTODY.md).
  2. PFC_REQUIRE_NPE=1 on ns1 — still unset (bus-wide fail-close would take down pfc-py-admin). Adapter now matches real CLI npe send|keygen|id (there is no npe seal). Probe: GET /v1/npe + health backends.npe. Lab identity /opt/pfc/etc/npe/lab.seed generated on host.
  3. Caddy hostname sync.pfc.georgelambert.org — done (DNS already 70.88.205.138; Caddy root /opt/pfc/docs/html/sync). Path /sync/ on docs.pfc remains.
  4. verae org — still empty.
  5. Website deep-links — done without rewriting 70 repos: https://georgelambert.org/pfc/, console footer, hub links.html, docs index.
  6. Admin console re-sign — POST /v1/admin/config live; TOTP required.
  7. Replication HTTP — resolved (:18784/health).