vh/esh-pfi-infrastructure
1
0
Fork 0
Code Issues 7 Pull Requests Actions Packages Projects Releases Wiki Activity

docs(albok-service): sealed unlock takes ~25 s; the argon2 memory warning is benign

Browse Source
This commit is contained in:
vh
2026-10-16 09:22:22 -07:00
parent 507d62d62a
commit f21fc07c23
1 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
stacks/albok-service/README.md
+2
View File
@@ -209,6 +209,8 @@ and what goes in it is Prime's call. albok-dev provisioned it on Prime's goal "l
```bash ```bash
# UNLOCK (after a VM reboot the wing comes up LOCKED, by design: no crypttab). No service restart is needed. # UNLOCK (after a VM reboot the wing comes up LOCKED, by design: no crypttab). No service restart is needed.
# The open takes ~25 s (argon2id keyslot: 215 MiB, time cost 55) and may print "keyslot operation could fail as it
# requires more than available memory": benign, cryptsetup compares against MemFree, not MemAvailable (2026-10-16 harness).
secret get albok/wing-key-personal-sealed | tr -d '\n' | ssh infra-ops@10.100.50.44 \ secret get albok/wing-key-personal-sealed | tr -d '\n' | ssh infra-ops@10.100.50.44 \
'sudo -n cryptsetup open --type luks2 --key-file=- /srv/albok/luks/personal.sealed.img albok-personal-sealed \ 'sudo -n cryptsetup open --type luks2 --key-file=- /srv/albok/luks/personal.sealed.img albok-personal-sealed \
&& sudo -n mount /dev/mapper/albok-personal-sealed /srv/albok/sealed/personal.sealed' && sudo -n mount /dev/mapper/albok-personal-sealed /srv/albok/sealed/personal.sealed'