14 lines
893 B
Markdown
14 lines
893 B
Markdown
# Master and repository key runbook
|
|
|
|
- Store the Compose master key outside the checkout. It must be a regular file,
|
|
at least 32 bytes, mode `0600`, owned by the service UID (`10001` for Compose).
|
|
Loss of this key destroys access to encrypted metadata secrets.
|
|
- Back up the master key independently from metadata and repositories; do not put it
|
|
in an image, Compose environment variable, log, ticket, or recovery bundle.
|
|
- Use the `admin recovery export` command with a passphrase file descriptor to create
|
|
a separately protected recovery bundle. Validate it on an isolated host.
|
|
- Rotate repository data keys only with `admin repository-key rotate`; retain prior
|
|
recovery material until a restore drill succeeds.
|
|
- If compromise is suspected, stop the worker, preserve evidence, rotate credentials,
|
|
export a fresh recovery bundle, and run a restore drill before resuming writes.
|