Files

T

Jon Chery 0f7f9cf914 docs(P27): zero-trust + OIDC + WebAuthn + threat-model docs (REQ-142)

---ci---
project: orca
phase: 27
milestone: v0.12
status: execute
---/ci---

docs/threat-model.md (STRIDE + OS surface + residual risks),
docs/oidc.md (bundled Dex + BYO + claim mapping + offline),
docs/webauthn.md (passkeys + RP ID + bootstrap sequence),
docs/security-runbook.md (seal/unseal + rotation + incident response).

2026-08-07 11:33:58 +00:00

1.1 KiB

Raw Blame History

Security Runbook (v0.12)

Master Key Seal/Unseal

orca cluster seal: encrypts master key with OIDC-derived key; prints 5 Shamir shards for offline recovery.
orca cluster unseal: operator authenticates via OIDC; master key unwrapped into memory; zeroed on shutdown.
orca cluster unseal --recovery: if IdP lost, present 3 of 5 shards.

Master Key Rotation

orca secrets rotate-master [--dry-run]: generates new master key, re-encrypts all namespace secrets, re-seals. Atomic + automatic rollback.

Incident Response

Revoke the compromised identity (OIDC user/group or SPIFFE SVID).
Rotate the master key (orca secrets rotate-master).
Review the audit log (orca doctor audit verifies the hash chain).
If the master key is compromised, all historical secrets are compromised (no forward secrecy).

Sudoers Audit

orca doctor proxmox audits the /etc/sudoers.d/orca file against the expected allowlist (pct + qm with NOEXEC; apt-get/dpkg excluded).

nft Audit

orca doctor nft audits the live nftables ruleset against the emitted one.

1.1 KiB Raw Blame History