vh/esh-pfi-infrastructure
1
0
Fork 0
Code Issues 7 Pull Requests Actions Packages Projects Releases Wiki Activity

feat(albok-service): unit 6 sealed wing personal/sealed — LUKS2 volume, gid 1513, rslave bind of /srv/albok/sealed

Browse Source 
albok-dev's host ask under Prime's goal "land all of u6". A 20 GiB LUKS2 file
with ext4, keyed only from the vault (piped over ssh, never on the host's
disk). The mountpoint is immutable while unmounted, and the mounted root is
1500:1513 0750 with .albok-wing. The parent is bound into the container with
rslave propagation: a lock then unlock with the service running showed through
without a restart. The wing is not in albok.yaml yet (albok-dev's release).
Runbook and backup posture are in the README.
This commit is contained in:
vh
2026-10-16 08:06:06 -07:00
parent 16e0dac572
commit 767b3af409
4 changed files with 40 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
stacks/albok-service/conf/group
+1
View File
@@ -40,3 +40,4 @@ albok:x:1500:
albok-read:x:1510:albok
albok-personal:x:1511:albok
albok-feedback:x:1512:albok
albok-sealed:x:1513:albok