132 lines
3.8 KiB
Markdown
132 lines
3.8 KiB
Markdown
|
Absolutely — let's think this through step by step. The goal is a **bootable authority host image** that’s offline, deterministic, and ready to handle domain admission, DAM signing, SOPS bundles, and PER generation. Here's a blueprint for assembling it.
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
## 1. Base OS
|
|||
|
|
|
|||
|
|
* Choose a **minimal Debian/Ubuntu** or SystemRescue-based environment.
|
|||
|
|
|
|||
|
|
* Needs basic POSIX tools, filesystem utilities, and networking disabled (offline by default).
|
|||
|
|
* Install **essential tools only**:
|
|||
|
|
|
|||
|
|
* `bash`, `coreutils`, `tar`, `gzip`, `xz`, `find`, `sha256sum`
|
|||
|
|
* `sops` binary for offline bundle handling
|
|||
|
|
* `git` optional, for versioning tools inside the image
|
|||
|
|
* Disable unnecessary daemons (`sshd`, `cron`) for security.
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
## 2. Filesystem Layout
|
|||
|
|
|
|||
|
|
Create the **ENC-ASL-AUTH-HOST** structure inside the image:
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
/asl-auth-host/
|
|||
|
|
├─ /domains/ # domain stores
|
|||
|
|
├─ /tools/ # binaries
|
|||
|
|
├─ /env-claims/ # environment snapshot hashes
|
|||
|
|
└─ /sops-bundles/ # encrypted bundles
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
* Use **read-only overlay** for system files
|
|||
|
|
* Persistent storage can be mounted as `/domains` or `/store` (ZFS, ext4, or Btrfs)
|
|||
|
|
* Optionally, set up **ZFS pools** for:
|
|||
|
|
|
|||
|
|
* `/domains/<domain-id>/store`
|
|||
|
|
* `/domains/<domain-id>/snapshots`
|
|||
|
|
* The image itself is **immutable** — only mounted storage is written to.
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
## 3. Tools to Include
|
|||
|
|
|
|||
|
|
* **asl-auth-host** binary — main authority program
|
|||
|
|
* **asl-rescue** binary — optional rescue support for SystemRescue-style data intake
|
|||
|
|
* **sops** — offline encryption/decryption of bundles
|
|||
|
|
* Optional helper scripts:
|
|||
|
|
|
|||
|
|
* `make-dam.sh` — create DAM artifacts
|
|||
|
|
* `sign-bundle.sh` — sign SOPS bundles
|
|||
|
|
* `verify-env.sh` — calculate env-claims
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
## 4. Boot Configuration
|
|||
|
|
|
|||
|
|
* Boot kernel options:
|
|||
|
|
|
|||
|
|
* Mount persistent storage for `/domains` (ZFS, ext4, etc.)
|
|||
|
|
* Mount overlay read-only system (`/tools`, `/env-claims`, `/sops-bundles`)
|
|||
|
|
* Auto-start a shell or **interactive prompt** for offline operation.
|
|||
|
|
* Optional: menu for:
|
|||
|
|
|
|||
|
|
* Create new domain
|
|||
|
|
* Sign DAM / issue certificates
|
|||
|
|
* Prepare SOPS bundle
|
|||
|
|
* Rescue/import artifacts
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
## 5. Domain Initialization
|
|||
|
|
|
|||
|
|
When first booting:
|
|||
|
|
|
|||
|
|
1. Generate **root key pair** for the domain.
|
|||
|
|
2. Optionally generate **DAM signer keys**.
|
|||
|
|
3. Create the domain directory:
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
/domains/<domain-id>/
|
|||
|
|
├─ store/
|
|||
|
|
├─ log/
|
|||
|
|
├─ snapshots/
|
|||
|
|
├─ certs/
|
|||
|
|
├─ policies/
|
|||
|
|
└─ dam/
|
|||
|
|
```
|
|||
|
|
4. Initialize **empty log**, empty store, and environment claim file:
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
/env-claims/<snapshot-id>.claim
|
|||
|
|
```
|
|||
|
|
5. Seed the domain with **common domain reference**, if applicable.
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
## 6. Certificates and Policies
|
|||
|
|
|
|||
|
|
* Root keys must be encrypted at rest.
|
|||
|
|
* DAMs signed using offline authority host root keys.
|
|||
|
|
* Policies included in `/domains/<domain-id>/policies/`.
|
|||
|
|
* All signed artifacts stored in `/sops-bundles/` for delivery.
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
## 7. Optional Persistence
|
|||
|
|
|
|||
|
|
* If you want the host **bootable from USB**:
|
|||
|
|
|
|||
|
|
* Overlay FS (SquashFS or ISO) for system binaries
|
|||
|
|
* Writable ZFS/Btrfs/EXT4 for `/domains` and `/sops-bundles`
|
|||
|
|
* This allows the system to remain **fully offline** but store persistent artifacts.
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
## 8. Recommended Approach
|
|||
|
|
|
|||
|
|
* **Immutable image** for the offline host (SquashFS or ISO)
|
|||
|
|
* **Writable storage** for domains (`/mnt/pool`) or USB disk
|
|||
|
|
* Use **ZFS datasets** for:
|
|||
|
|
|
|||
|
|
* Block storage
|
|||
|
|
* Snapshots of logs & store
|
|||
|
|
* Pre-load binaries for deterministic PER generation, DAM signing, and rescue scripts.
|
|||
|
|
* Environment claims stored and optionally signed before any DAM operation.
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
If you want, I can **write a concrete build script outline** (e.g., Debian-based ISO with overlay + ZFS pools + included binaries + directory structure), so you have a starting point to actually produce the bootable auth host image.
|
|||
|
|
|
|||
|
|
Do you want me to do that next?
|
|||
|
|
|