Microcluster Ansible - Infrastructure automation
5dfdd57a17
index_keys.php appeared on both machines during the key ceremony on 28 Oct 2026, and it is the one file from the PII encryption that the archive must carry. Everything else is recoverable without it: RoleKeys::createRole() seals every role's private half to the recovery key in role_keys.wrapped_private (measured on production: 80 bytes for root, secretariat, shop and mailer), so the database backup plus the recovery key on paper hands them back through recover --print-private. index_keys.php is 32 random bytes that exist in no table. That is also why a65 needs no archive of its own even though it holds two key files: its index_keys.php is byte-identical to this one (same sha256) and its mailer_private.php lives in the database. The colleague had this down as an open gap; it turns out to be closed by the design rather than by more ansible. The list is a condition, not documentation -- the archive is not replaced when a listed file is missing -- so the comment now says out loud that a name goes in only once the file exists. |
||
|---|---|---|
| .github | ||
| .vscode | ||
| files | ||
| playbooks | ||
| plugins/action | ||
| templates | ||
| vars | ||
| .gitignore | ||
| admin.yml | ||
| AGENTS.md | ||
| debug_503_output.txt | ||
| domains.txt | ||
| hosts | ||
| ible-galaxy install marcoszas.mastodon_install_and_maintenance | ||
| inventory | ||
| mailboxes.tsv | ||
| Makefile | ||
| microcluster-logo.png | ||
| microcluster-social.jpg | ||
| microcluster-social.png | ||
| microcluster.jpg | ||
| netbox_test_inventory.yml | ||
| public.yml | ||
| public.yml.bak | ||
| README.md | ||
| schema.yml | ||
| secrets | ||
| server.yml | ||
| signal-2026-04-13-214324.jpeg | ||
| sql.yml | ||
| sqlserver.yml | ||
| test-kubinart-certs.yml | ||
