dohertj2/scadaproj
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(secrets): production replication topologies decided — OtOpcUa Akka pair-local, ScadaBridge central gRPC hub (pull-only); scadaproj#3

Browse Source 
Design doc + runbook Production-enablement section + GAPS/index updates.
The previously-untracked production-KEK decision is now recorded: one
fleet-wide KEK via appsettings/env (never committed); ScadaBridge rejects
the SqlServer hub on topology grounds (sites talk to central, never the
DB) in favor of a new ZB.MOM.WW.Secrets.Replicator.Grpc package —
pull-only, updates originate at central only, by design.

Claude-Session: https://claude.ai/code/session_014WNM4vjoVksyyBraTXSZE1
This commit is contained in:
Joseph Doherty
2026-08-07 05:28:46 -04:00
parent 537a4f524d
commit 591307c13e
4 changed files with 166 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/secrets/GAPS.md
+13 -3
View File
@@ -168,9 +168,19 @@ project 38/38 green.
page owning the route with `@rendermode InteractiveServer` + policy/route-parity pin tests
(`SecretsPageWiringTests`); Playwright-verified live on the rig (circuit + working Add-secret).
The wrapper is the reference pattern for any static-router consumer of Secrets.Ui.
**Production/wonder enablement is deliberately NOT done** — needs its own decision + real KEK
distribution (never the committed dev key) per the clustered-secrets runbook.
- ✅ ScadaBridge's hub topology **is** live-validated and safe to enable (config + a shared KEK).
**Production/wonder enablement is deliberately NOT done** — ~~needs its own decision + real KEK
distribution (never the committed dev key) per the clustered-secrets runbook~~ **the decision is
now made and tracked (2026-08-07,
[scadaproj#3](https://gitea.dohertylan.com/dohertj2/scadaproj/issues/3); design
`docs/plans/2026-08-07-secrets-production-topology-and-grpc-hub.md`):** OtOpcUa = Akka
pair-local with one fleet-wide appsettings-delivered KEK; ScadaBridge = a new central gRPC hub
replicator (`ZB.MOM.WW.Secrets.Replicator.Grpc`, pull-only — updates originate at central only),
because the SqlServer hub's site-side connection string violates ScadaBridge's
sites-talk-to-central-not-the-DB rule. Enablement waits on the hub package (ScadaBridge) and the
pair-local re-gate on the post-Phase-6 rig (OtOpcUa).
- ✅ ScadaBridge's hub topology **is** live-validated and technically safe to enable — but the
2026-08-07 decision rejects it for production on topology grounds (site nodes must not hold a
central SQL connection string); superseded by the gRPC hub above.
Harness: `scratchpad/livegate/` (two scenarios, `akka` / `sql`; not committed).