Genesis makes the root secrets and the operator key, and installs the vault #14

2026-09-21T07:30:02Z

jschoubben commented

2026-09-21 07:30:02 +00:00

novox/hq ADR 0085 (amended), issue 071. Merge third of five, after mesh-controller and mesh-catalog (the installer calls operator key set, secret export, and installs mesh-vault, lavinmq).

The template's bootstrap / guest are replaced by credentials the installer makes once and keeps at the modules' own-secret paths; the store reads its password from a file, the broker's default account is given the new password by a verified action, the produced bundle is 0600, and the transcript never prints a value.
After enrolment and before the first secret accept, the operator key is made beside the bundle and its public half given to the mesh.
Phase three adopts the broker as lavinmq beside the store, installs mesh-vault, and ends by writing the operator-sealed export beside the key.
Refuses to run on a machine whose store or broker already exists with no credential file (an earlier installer's mesh).

Proven by one-node-mesh.test.ts 22/22 (new step V5). Reviewed; four issues found and fixed in 70d0f36 and d756eff.

novox/hq ADR 0085 (amended), issue 071. Merge third of five, after mesh-controller and mesh-catalog (the installer calls `operator key set`, `secret export`, and installs `mesh-vault`, `lavinmq`). - The template's `bootstrap` / `guest` are replaced by credentials the installer makes once and keeps at the modules' own-secret paths; the store reads its password from a file, the broker's default account is given the new password by a verified action, the produced bundle is 0600, and the transcript never prints a value. - After enrolment and before the first `secret accept`, the operator key is made beside the bundle and its public half given to the mesh. - Phase three adopts the broker as `lavinmq` beside the store, installs `mesh-vault`, and ends by writing the operator-sealed export beside the key. - Refuses to run on a machine whose store or broker already exists with no credential file (an earlier installer's mesh). Proven by `one-node-mesh.test.ts` 22/22 (new step V5). Reviewed; four issues found and fixed in 70d0f36 and d756eff.

jschoubben added 4 commits 2026-09-21 07:30:03 +00:00

Genesis makes the root secrets, the operator key, and installs the vault ee0c8b856e

The template raises the store with the password 'bootstrap' and the broker
with its image's default administrator, and the installer carried both into
the mesh as accepted secrets — permanent, and not secret (novox/hq issue 071).

Now the installer makes both credentials, once, at the paths the postgres and
lavinmq modules declare as their own secrets, rewrites the produced bundle to
use them (the store reads its password from a file; the broker's default
account is given the new password by an action before anything dials it), and
writes the bundle at 0600 since it now carries them.

Before the first secret is accepted it makes the operator's sealing key beside
the bundle and gives the mesh the public half, so everything minted from there
is sealed to it too (ADR 0085, amended). Phase three adopts the broker as the
lavinmq module beside the store and installs mesh-vault as a foundation module;
the run ends by writing the operator-sealed export beside the key.

The export is its own installer step, and the result names the operator files 036af3cfdc

Installer review: secrets are staged privately, and a bundle is 0600 whether or not it existed 70d0f36896

From review: the store and broker passwords genesis makes were carried into
the controller through a world-readable file in /tmp, a bundle left at 0644 by
an earlier installer kept that mode while now holding them, a mesh raised by
the old installer would have been handed new passwords its servers do not have,
and the broker-admin action's marker did not depend on the value. Secrets now
stage in a 0700 directory owned by the controller's account; the bundle is
chmod'd; an existing store or broker volume with no credential file is refused
by name; the marker holds the password's fingerprint. Also: one install path
for the store, broker and vault, no error-string matching for the operator
key, and no unreachable fallback for the superuser.

The broker-admin marker ends in a newline, and the transcript never says a credential d756effc33

The verify reads the marker with the shell's read, which fails at end of file
without a line ending; the action ran and its verify said no. And the applier
reports each action with its command line, two of which now carry the real
store and broker passwords — the installer masks the values it made in
everything it says.

jschoubben merged commit e30a6b08ea into main

2026-09-21 08:03:17 +00:00

jschoubben deleted branch feat/secrets-vault

2026-09-21 08:03:17 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-host#14