amduat-api/ops/legacy/ASL-AUTH-HOST ISO + Overlay Directory Layout.md

Perfect! Here’s a concrete directory layout blueprint for your asl-auth-host ISO + overlay, ready to drop in binaries, certificates, and configuration. This integrates the concepts we discussed: domains, certificates, personal/common datasets, and the overlay structure.

---

ASL-AUTH-HOST ISO + Overlay Directory Layout

/iso_root/                  # Root of ISO filesystem (from debootstrap)
/bin/                       # Executables
    asl-auth-host            # Main host binary
    asl-rescue               # Rescue binary
    init-asl-host.sh         # Init script to bootstrap datasets & services
    helper-mount.sh          # Optional helper scripts
/etc/
    asl-auth-host/
        config.yaml          # Host config (domains, policies, SOPS paths)
        policy.hash          # Optional policy hash for offline validation
/var/lib/asl/               # ASL storage root
    common/                 # Courtesy/common domain data
        blocks/             # Encrypted blocks or artifacts
        index/              # Store index for common domain
        snapshots/          # Snapshots for deterministic reconstruction
        logs/               # Append-only log
    personal/               # Personal domain data
        blocks/             # Encrypted personal blocks
        index/
        snapshots/
        logs/
    pools/                  # Placeholder directories for ZFS datasets if used
/var/lib/asl/certs/         # Certificates and DAM bundles
    root-offline/           # Offline root certs
    domain-authority/       # Signed DAM bundles
    sops/                   # Optional SOPS bundles
/var/log/                   # Host logs
    asl-auth-host.log

---

Notes

1. ISO Root (/iso_root)

   • Populated via debootstrap in Debian container. Overlay merges your binaries and directory structure.

2. Binaries (/bin)

   • Place asl-auth-host and asl-rescue here.
   • Init scripts can handle mounting ZFS datasets or preparing /var/lib/asl before starting the store.

3. Host Configuration (/etc/asl-auth-host)

   • config.yaml contains domain IDs, policies, and SOPS bundle paths.
   • policy.hash allows offline verification of policies before admission.

4. ASL Storage (/var/lib/asl)

   • Common: Courtesy domain with pre-seeded blocks/artifacts.
   • Personal: New private domain for rescued material.
   • Pools: Reserved for mounting ZFS pools when booted.

5. Certificates (/var/lib/asl/certs)

   • Offline roots for verifying DAM signatures.
   • Domain authority DAM bundles received via SOPS.

6. Logging (/var/log)

   • Minimal logs for host activity, index writes, and rescue operations.

---

Optional: Overlay Sub-structure for Development

/overlay/
    bin/
        asl-auth-host
        asl-rescue
        init-asl-host.sh
    etc/
        asl-auth-host/config.yaml
        asl-auth-host/policy.hash
    var/
        lib/
            asl/
                common/
                personal/
                pools/
                certs/
        log/

This overlay merges into /iso_root during ISO build.

---

This layout supports bootstrapping a personal domain from scratch, seeding the courtesy/common domain, and later integrating offline DAM bundles. It also keeps your binaries and helper scripts isolated in /bin and /etc configs clean.

---

I can also draft an example config.yaml for the host showing:

• Domain IDs
• Courtesy lease definitions
• Default SOPS bundle paths
• Snapshot/retention policies

…so your host is ready to pick up a new domain or rescued data.

Do you want me to draft that next?