Fork: 0
OpenStack / openstack-caracal-dc-dc
Transfer to URL with SHA Find file
Newer
Older
openstack-caracal-dc-dc / docs / changelog-20260715-creds-consolidation.md
@JANeumatrix JANeumatrix 22 hours ago 3 KB Consolidate credential/env sprawl into ~/vr1-office1-creds/ (SEC-009); seed memory
Raw Blame History

2026-07-15 -- credential/env consolidation into ~/vr1-office1-creds/ (SEC-009)

Operator-approved. Closes a credential SPRAWL + world-readable exposure on vcloud, and establishes the standing per-site consolidation convention.

The finding

Three env files sat loose in ~, outside the consolidated ~/vr1-office1-creds/ folder:

~/.vr1-netbox.env    0600   upstream/v1-draft NetBox token (NETBOX_URL + NETBOX_TOKEN)
~/vr1-office1.env    0600   OPNsense edge config (WAN/LAN/DHCP/root-hash/SSH-key vars)
~/vr1-stage1.env     0664   OpenTofu TF_VAR_* -- INCLUDING TF_VAR_maas_api_key (a MAAS secret)

vr1-stage1.env at 0664 (group/world-readable) held a MAAS API key -- a real exposure, not just untidiness. ~/vr1-office1-creds/tailscale-authkey.txt was also 0664. None were created this session (mtimes 2026-07-10..12); a prior session in this continuity scattered them.

What was done (files OUTSIDE the repo; not committed, recorded here)

  • Moved all three into ~/vr1-office1-creds/ (vr1-netbox.env, vr1-office1.env, vr1-stage1.env).
  • chmod 600 on every sensitive file in the folder -- fixed the two 0664 files.
  • No file CONTENTS were read; key NAMES only were listed to identify each file's purpose.
  • Fixed a D-119 follow-up the sweep could not reach (it is outside the repo): vr1-stage1.env had TF_VAR_dc1_pool_path / TF_VAR_dc2_pool_path -> renamed to TF_VAR_vr1_dc0_pool_path / TF_VAR_vr1_dc1_pool_path to match the renamed OpenTofu variables.

Repo changes (committed)

  • Active path references updated old ~/.vr1-netbox.env -> ~/vr1-office1-creds/vr1-netbox.env: netbox/prod-draft-dump.py (docstring + usage + error message), runbooks/dc-dc-phase1-office1- standup.md (Step 10b table), docs/vr1-office1-as-built.md, docs/session-ledger.md. Dated changelog/incident records that reference the OLD paths are left as historical snapshots.
  • docs/vr1-office1-as-built.md secrets table: added the three env files + the consolidation note. Corrected a wrong assumption recorded mid-session -- the SANDBOX NetBox token is NOT on vcloud; it is on office1-netbox (/root/netbox-secrets/). vr1-netbox.env is the UPSTREAM token only.
  • docs/security-ledger.md: SEC-009 (this finding, REMEDIATED) + the STANDING CONVENTION.

Standing convention (SEC-009)

Per-site: ALL sensitive + env/config files live in one ~/<site>-creds/ folder (0700; files 0600; public keys 0644). No loose env files in ~. ~/vr1-dc0-creds/ and ~/vr1-dc1-creds/ follow the same pattern FROM DAY ONE when DC deployment starts. This is a DATA-LOSS / continuity control first: scattered creds get lost between sessions and after compaction. Real credential hardening (rotation, revocation) stays deferred to post-teardown redeploy cycles -- this is a closed in-house test.

Also seeded agent memory (was empty): the creds convention and the closed-test posture, so neither is re-lost at the next compaction.

Revert

Repo edits: git revert <this commit>. The file moves are outside the repo -- to reverse, move the three env files back to ~ (not recommended: it re-opens the sprawl and the 0664 exposure).