From 3cae10003895b674057fdf6666c486f7b58d4264 Mon Sep 17 00:00:00 2001 From: Inferencebot Date: Fri, 30 Oct 2026 22:49:52 +0000 Subject: [PATCH] migration: record the off-box credential state; one custodian is a co-op risk Passphrase + Vaultwarden master password confirmed off-box in the operator's KeePass vault. S3 secretAccessKey still unconfirmed - the one credential not in the co-op's own JSON. Notes that the Vault is Vaultwarden (nothing to sync with Bitwarden) and that all break-glass copies sit with a single custodian. --- cloudron-server-migration.md | 25 ++++++++++++++++++------- 1 file changed, 18 insertions(+), 7 deletions(-) diff --git a/cloudron-server-migration.md b/cloudron-server-migration.md index ad2ca82..a62ed98 100644 --- a/cloudron-server-migration.md +++ b/cloudron-server-migration.md @@ -172,16 +172,27 @@ and a spot-check misses. Status as of 2026-10-30: -- [x] **Cloudron backup passphrase** — the operator holds it off-box (confirmed 2026-10-30). A restore - asks for this first; without it the backup is unreadable, so this was the real blocker. -- [ ] **S3 `secretAccessKey`** — **not** in the off-box JSON, which carries `accessKeyId` only. - Retrieve it from the Infomaniak console and keep it with the passphrase. A restore begins by - pointing the new Cloudron at the backup target, so it must be in hand before the window opens. -- [ ] **Vault export** — the Vault is an app on the box being migrated, so its contents are not - off-box until exported. Take the export before the freeze. +- [x] **Cloudron backup passphrase** — off-box (confirmed 2026-10-30), in the operator's KeePass vault. + A restore asks for this first; without it the backup is unreadable. This was the real blocker. +- [x] **Vaultwarden master password + admin credentials** — off-box in the same KeePass vault + (2026-10-30). The Vault's own database is inside the Cloudron backup, so a restore returns it + whole; the master password is what makes the restored contents readable. Note the shape of this: + `vault.inference.coop` runs `com.github.bitwardenrs` — **Vaultwarden**, the open-source Bitwarden + server — so official Bitwarden clients already work against it. There is nothing to sync. +- [ ] **S3 `secretAccessKey`** — **confirm it is in the KeePass vault.** This is the one credential + absent from the co-op's own off-box JSON (that carries `accessKeyId` only), and a restore begins + by pointing the new Cloudron at the backup target — so it must be typeable before the window. +- [ ] **Vault export** (optional insurance) — the contents already ride in the Cloudron backup, so this + is not the source of truth. Cheap protection against the app restoring but its DB coming back + damaged. - [x] **restic passphrase** (agent host, different backup) — in that host's `.env`, and that host is not the one migrating, so it stays recoverable either way. +**Continuity, not just safety.** All of the above live in one person's KeePass file. For a +co-operative that is a governance risk as much as an ops one: if the one custodian is unavailable, so +is the infrastructure. The cheap fixes are a second custodian (or a sealed shared copy), and a line in +this repo recording *where* the break-glass copies are held — never the secrets themselves. + ## The announcement, ready to post in #updates > **Scheduled maintenance: , , – UTC.** We are moving our servers to a new host