117 lines
3.2 KiB
Markdown
117 lines
3.2 KiB
Markdown
|
Perfect! Here’s an example `config.yaml` for your `asl-auth-host`. This integrates domains, courtesy leases, snapshots, and SOPS bundle paths in a way that your host can start in “ready-for-pickup” mode or perform a rescue.
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
## `/etc/asl-auth-host/config.yaml`
|
|||
|
|
|
|||
|
|
```yaml
|
|||
|
|
# ASL-AUTH-HOST Configuration
|
|||
|
|
# Defines domains, policies, and SOPS bundles for bootstrap or rescue
|
|||
|
|
|
|||
|
|
host:
|
|||
|
|
name: "asl-auth-host-01"
|
|||
|
|
version: "0.1"
|
|||
|
|
mode: "rescue" # modes: "rescue" | "admission" | "normal"
|
|||
|
|
|
|||
|
|
domains:
|
|||
|
|
common:
|
|||
|
|
id: "00000000-0000-0000-0000-000000000001" # Courtesy/common domain
|
|||
|
|
type: "courtesy"
|
|||
|
|
description: "Shared courtesy domain for new users or bootstrapped material"
|
|||
|
|
path: "/var/lib/asl/common"
|
|||
|
|
snapshot_retention: 30d
|
|||
|
|
allowed_operations:
|
|||
|
|
- read
|
|||
|
|
- write
|
|||
|
|
- append
|
|||
|
|
courtesy_lease: 7d # Default grace period for newcomers
|
|||
|
|
personal:
|
|||
|
|
id: "00000000-0000-0000-0000-000000000002" # Personal private domain
|
|||
|
|
type: "private"
|
|||
|
|
description: "Private domain for rescued material or user-owned data"
|
|||
|
|
path: "/var/lib/asl/personal"
|
|||
|
|
snapshot_retention: 90d
|
|||
|
|
allowed_operations:
|
|||
|
|
- read
|
|||
|
|
- write
|
|||
|
|
- append
|
|||
|
|
- seal
|
|||
|
|
- gc
|
|||
|
|
|
|||
|
|
certificates:
|
|||
|
|
root_offline_path: "/var/lib/asl/certs/root-offline"
|
|||
|
|
domain_authority_path: "/var/lib/asl/certs/domain-authority"
|
|||
|
|
sops_bundle_path: "/var/lib/asl/certs/sops"
|
|||
|
|
|
|||
|
|
policy:
|
|||
|
|
hash_file: "/etc/asl-auth-host/policy.hash"
|
|||
|
|
description: "Offline policy hash used to verify compliance before admission or rescue"
|
|||
|
|
|
|||
|
|
logging:
|
|||
|
|
path: "/var/log/asl-auth-host.log"
|
|||
|
|
level: "INFO"
|
|||
|
|
|
|||
|
|
store:
|
|||
|
|
type: "zfs" # or "posix"
|
|||
|
|
pools:
|
|||
|
|
- name: "common_pool"
|
|||
|
|
mount_point: "/var/lib/asl/common"
|
|||
|
|
- name: "personal_pool"
|
|||
|
|
mount_point: "/var/lib/asl/personal"
|
|||
|
|
enable_snapshotting: true
|
|||
|
|
snapshot_prefix: "asl_snap"
|
|||
|
|
|
|||
|
|
# Optional hooks for init scripts
|
|||
|
|
hooks:
|
|||
|
|
pre_start: "/bin/init-asl-host.sh"
|
|||
|
|
post_start: "/bin/helper-mount.sh"
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
### Notes:
|
|||
|
|
|
|||
|
|
1. **`host.mode`**:
|
|||
|
|
|
|||
|
|
* `"rescue"` → SystemRescue boot with ready-for-pickup for old material.
|
|||
|
|
* `"admission"` → Host expects to receive a DAM and SOPS bundle for new personal domain.
|
|||
|
|
* `"normal"` → Standard operation with personal domain active.
|
|||
|
|
|
|||
|
|
2. **Domains**:
|
|||
|
|
|
|||
|
|
* **Common**: Courtesy domain, short-term leases for newcomers.
|
|||
|
|
* **Personal**: Private domain, snapshots and sealing enabled.
|
|||
|
|
|
|||
|
|
3. **Certificates**:
|
|||
|
|
|
|||
|
|
* Paths to offline root certs, DAM bundles, and SOPS bundles.
|
|||
|
|
|
|||
|
|
4. **Policy hash**:
|
|||
|
|
|
|||
|
|
* Offline verification ensures host doesn’t act on incompatible policies.
|
|||
|
|
|
|||
|
|
5. **Store config**:
|
|||
|
|
|
|||
|
|
* Can be POSIX or ZFS-based.
|
|||
|
|
* Supports snapshotting for deterministic recovery.
|
|||
|
|
|
|||
|
|
6. **Hooks**:
|
|||
|
|
|
|||
|
|
* Allows you to initialize ZFS pools, mount overlays, or start ASL binaries.
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
This config gives you a **bootable, ready-for-pickup SystemRescue node** that can handle:
|
|||
|
|
|
|||
|
|
* Receiving old data
|
|||
|
|
* Creating your personal domain
|
|||
|
|
* Storing material safely in courtesy/common domain
|
|||
|
|
* Verifying offline DAM bundles before admission
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
I can also **draft the accompanying init script (`init-asl-host.sh`)** that reads this config, sets up domains, mounts pools, and prepares the store for immediate rescue or admission.
|
|||
|
|
|
|||
|
|
Do you want me to do that next?
|
|||
|
|
|