George Lambert
aa7c837493
Some checks are pending
review / inventory (push) Waiting to run
UserReview leftovers implemented without rewriting 70 website repos and without fail-closing pfc-py-admin.
11 lines
1.1 KiB
Markdown
11 lines
1.1 KiB
Markdown
# UserReview
|
|
|
|
Decisions to confirm later. Work continued with guesses in `TODO-With-User.MD`.
|
|
|
|
1. **System public key custody** — **lab implemented.** Ed25519 on host `/opt/pfc/etc/sm-keys/` (0600). Rotate: `scripts/rotate_config_key.py` (re-sign + admin-history). NPE: `npe keygen --rotate`. Production HSM/PKCS#11 still hardware-not-present (`docs/HSM-CUSTODY.md`).
|
|
2. **`PFC_REQUIRE_NPE=1` on ns1** — **still unset** (bus-wide fail-close would take down pfc-py-admin). Adapter now matches real CLI `npe send|keygen|id` (there is no `npe seal`). Probe: `GET /v1/npe` + health `backends.npe`. Lab identity `/opt/pfc/etc/npe/lab.seed` generated on host.
|
|
3. **Caddy hostname `sync.pfc.georgelambert.org`** — **done** (DNS already 70.88.205.138; Caddy root `/opt/pfc/docs/html/sync`). Path `/sync/` on docs.pfc remains.
|
|
4. **verae org** — still empty.
|
|
5. **Website deep-links** — **done without rewriting 70 repos:** `https://georgelambert.org/pfc/`, console footer, hub `links.html`, docs index.
|
|
6. **Admin console re-sign** — `POST /v1/admin/config` live; TOTP required.
|
|
7. **Replication HTTP** — resolved (`:18784/health`).
|