dohertj2/scadaproj
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(secrets): clustered replication ENABLED + proven on the OtOpcUa docker-dev rig; #482 closed

Browse Source 
Claude-Session: https://claude.ai/code/session_01BL2Vu1ESDQ9SCN4gVKkdts
This commit is contained in:
Joseph Doherty
2026-07-18 16:01:15 -04:00
parent 8d9bcedaf3
commit fbb788d463
2 changed files with 13 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CLAUDE.md
+1 -1
View File
File diff suppressed because one or more lines are too long
components/secrets/GAPS.md
+12 -2
View File
@@ -149,8 +149,18 @@ project 38/38 green.
8/8; plain `ActorSystem`, no TestKit — xunit.v3-compatible). 8/8; plain `ActorSystem`, no TestKit — xunit.v3-compatible).
**Tracked:** [`scadaproj#1`](https://gitea.dohertylan.com/dohertj2/scadaproj/issues/1) (the defect — **Tracked:** [`scadaproj#1`](https://gitea.dohertylan.com/dohertj2/scadaproj/issues/1) (the defect —
fixed, CLOSED) and [`lmxopcua#482`](https://gitea.dohertylan.com/dohertj2/lmxopcua/issues/482) fixed, CLOSED) and [`lmxopcua#482`](https://gitea.dohertylan.com/dohertj2/lmxopcua/issues/482)
(open only for the per-environment decision to enable `Secrets:Replication:Enabled`, which stays (CLOSED 2026-07-18 — fully adopted).
default-false and requires the same KEK on every node first). - ✅ **ENABLED on the OtOpcUa docker-dev rig (2026-07-18, `lmxopcua master @ c878fbbd`)** — all six
host nodes run `Secrets:Replication:Enabled=true` with one shared dev KEK (compose `x-secrets-env`
anchor, `${OTOPCUA_SECRETS_KEK:-…}` dev default). Live-proven on the rig: no startup deadlock across
repeated restarts; a secret seeded into site-a-1's store alone converged to all five peers within
≤60 s with **byte-identical ciphertext on all six nodes** (same sha256/kek_id), decrypt-verified on
central-2 + site-b-2; site-b-2 restart rejoined with the row intact. Found during verification and
filed as [`lmxopcua#483`](https://gitea.dohertylan.com/dohertj2/lmxopcua/issues/483): the AdminUI
`/admin/secrets` page is non-interactive (Secrets.Ui RCL has no `@rendermode`; hosts applying render
modes per-page get a dead page — check the other three apps for the same pattern).
**Production/wonder enablement is deliberately NOT done** — needs its own decision + real KEK
distribution (never the committed dev key) per the clustered-secrets runbook.
- ✅ ScadaBridge's hub topology **is** live-validated and safe to enable (config + a shared KEK). - ✅ ScadaBridge's hub topology **is** live-validated and safe to enable (config + a shared KEK).
Harness: `scratchpad/livegate/` (two scenarios, `akka` / `sql`; not committed). Harness: `scratchpad/livegate/` (two scenarios, `akka` / `sql`; not committed).