113 lines
3.6 KiB
Markdown
113 lines
3.6 KiB
Markdown
Perfect! Here’s a **concrete directory layout blueprint** for your `asl-auth-host` ISO + overlay, ready to drop in binaries, certificates, and configuration. This integrates the concepts we discussed: domains, certificates, personal/common datasets, and the overlay structure.
|
||
|
||
---
|
||
|
||
## ASL-AUTH-HOST ISO + Overlay Directory Layout
|
||
|
||
```
|
||
/iso_root/ # Root of ISO filesystem (from debootstrap)
|
||
/bin/ # Executables
|
||
asl-auth-host # Main host binary
|
||
asl-rescue # Rescue binary
|
||
init-asl-host.sh # Init script to bootstrap datasets & services
|
||
helper-mount.sh # Optional helper scripts
|
||
/etc/
|
||
asl-auth-host/
|
||
config.yaml # Host config (domains, policies, SOPS paths)
|
||
policy.hash # Optional policy hash for offline validation
|
||
/var/lib/asl/ # ASL storage root
|
||
common/ # Courtesy/common domain data
|
||
blocks/ # Encrypted blocks or artifacts
|
||
index/ # Store index for common domain
|
||
snapshots/ # Snapshots for deterministic reconstruction
|
||
logs/ # Append-only log
|
||
personal/ # Personal domain data
|
||
blocks/ # Encrypted personal blocks
|
||
index/
|
||
snapshots/
|
||
logs/
|
||
pools/ # Placeholder directories for ZFS datasets if used
|
||
/var/lib/asl/certs/ # Certificates and DAM bundles
|
||
root-offline/ # Offline root certs
|
||
domain-authority/ # Signed DAM bundles
|
||
sops/ # Optional SOPS bundles
|
||
/var/log/ # Host logs
|
||
asl-auth-host.log
|
||
```
|
||
|
||
---
|
||
|
||
### Notes
|
||
|
||
1. **ISO Root (`/iso_root`)**
|
||
|
||
* Populated via debootstrap in Debian container. Overlay merges your binaries and directory structure.
|
||
|
||
2. **Binaries (`/bin`)**
|
||
|
||
* Place `asl-auth-host` and `asl-rescue` here.
|
||
* Init scripts can handle mounting ZFS datasets or preparing `/var/lib/asl` before starting the store.
|
||
|
||
3. **Host Configuration (`/etc/asl-auth-host`)**
|
||
|
||
* `config.yaml` contains domain IDs, policies, and SOPS bundle paths.
|
||
* `policy.hash` allows offline verification of policies before admission.
|
||
|
||
4. **ASL Storage (`/var/lib/asl`)**
|
||
|
||
* **Common**: Courtesy domain with pre-seeded blocks/artifacts.
|
||
* **Personal**: New private domain for rescued material.
|
||
* **Pools**: Reserved for mounting ZFS pools when booted.
|
||
|
||
5. **Certificates (`/var/lib/asl/certs`)**
|
||
|
||
* Offline roots for verifying DAM signatures.
|
||
* Domain authority DAM bundles received via SOPS.
|
||
|
||
6. **Logging (`/var/log`)**
|
||
|
||
* Minimal logs for host activity, index writes, and rescue operations.
|
||
|
||
---
|
||
|
||
### Optional: Overlay Sub-structure for Development
|
||
|
||
```
|
||
/overlay/
|
||
bin/
|
||
asl-auth-host
|
||
asl-rescue
|
||
init-asl-host.sh
|
||
etc/
|
||
asl-auth-host/config.yaml
|
||
asl-auth-host/policy.hash
|
||
var/
|
||
lib/
|
||
asl/
|
||
common/
|
||
personal/
|
||
pools/
|
||
certs/
|
||
log/
|
||
```
|
||
|
||
*This overlay merges into `/iso_root` during ISO build.*
|
||
|
||
---
|
||
|
||
This layout **supports bootstrapping a personal domain from scratch**, seeding the courtesy/common domain, and later integrating offline DAM bundles. It also keeps your binaries and helper scripts isolated in `/bin` and `/etc` configs clean.
|
||
|
||
---
|
||
|
||
I can also **draft an example `config.yaml` for the host** showing:
|
||
|
||
* Domain IDs
|
||
* Courtesy lease definitions
|
||
* Default SOPS bundle paths
|
||
* Snapshot/retention policies
|
||
|
||
…so your host is ready to pick up a new domain or rescued data.
|
||
|
||
Do you want me to draft that next?
|
||
|