docs/runbooks/back-up-the-age-key.md:196,
under "What this still does not solve":
One key, one person. Every secret in this repository — four SNMP communities,
the Grafana admin password, the Alertmanager webhook, and now the renderer token
— decrypts with a single age private key held by a single человек. The runbook
defers a second offline recipient until "the lab stops being a one-person
project".
That framing is worth revisiting, because the risk it describes is not about
team size. If the key is lost, every encrypted value in git history becomes
permanently undecryptable, and the recovery path is re-deriving each credential
from the device it belongs to — four SNMP rotations on hardware, one of which
(neo) cannot persist a community deletion and needs a reboot to change.
.sops.yaml supports multiple recipients, so the mechanism costs nothing; what
it needs is somewhere to put the second key.
Related, and probably the same piece of work
make secrets-verify-backup is the only thing that proves a backup key works,
and it has no schedule. Tracked separately.oracle is an idle machine looking for a purpose, and holding a second
recipient is a job that suits a machine with a slow disk and nothing else to
do.
Found while reading the runbooks during #12.
docs/runbooks/back-up-the-age-key.md:196,under "What this still does not solve":
One key, one person. Every secret in this repository — four SNMP communities,
the Grafana admin password, the Alertmanager webhook, and now the renderer token
— decrypts with a single age private key held by a single человек. The runbook
defers a second offline recipient until "the lab stops being a one-person
project".
That framing is worth revisiting, because the risk it describes is not about
team size. If the key is lost, every encrypted value in git history becomes
permanently undecryptable, and the recovery path is re-deriving each credential
from the device it belongs to — four SNMP rotations on hardware, one of which
(
neo) cannot persist a community deletion and needs a reboot to change..sops.yamlsupports multiple recipients, so the mechanism costs nothing; whatit needs is somewhere to put the second key.
Related, and probably the same piece of work
make secrets-verify-backupis the only thing that proves a backup key works,and it has no schedule. Tracked separately.
oracleis an idle machine looking for a purpose, and holding a secondrecipient is a job that suits a machine with a slow disk and nothing else to
do.
Found while reading the runbooks during #12.