feat(v2): complete v2 reimplementation

2026-07-31 13:33:39 +02:00
parent 396219e776
commit bd107d6a30
137 changed files with 20737 additions and 155 deletions
@@ -0,0 +1,13 @@
+# Master and repository key runbook
+
+- Store the Compose master key outside the checkout. It must be a regular file,
+  at least 32 bytes, mode `0600`, owned by the service UID (`10001` for Compose).
+  Loss of this key destroys access to encrypted metadata secrets.
+- Back up the master key independently from metadata and repositories; do not put it
+  in an image, Compose environment variable, log, ticket, or recovery bundle.
+- Use the `admin recovery export` command with a passphrase file descriptor to create
+  a separately protected recovery bundle. Validate it on an isolated host.
+- Rotate repository data keys only with `admin repository-key rotate`; retain prior
+  recovery material until a restore drill succeeds.
+- If compromise is suspected, stop the worker, preserve evidence, rotate credentials,
+  export a fresh recovery bundle, and run a restore drill before resuming writes.