Go to file

tegwick c5761884f4 feat(sso-mfa): Phase 0a bootstrap tooling (NK-WP-0001-T01)

- sso-mfa/bootstrap/gen-secrets.sh: generates all pre-cluster secrets
  (PI_SECRET_KEY, PI_PEPPER, DB passwords, Keycloak admin, break-glass)
  into a structured secrets/ directory; prints summary with truncated values.
  PI_ENCFILE deferred — must be generated inside the privacyIDEA container.
- sso-mfa/bootstrap/pack-bundle.sh: age-encrypts the secrets directory into
  an offsite ops bundle.
- sso-mfa/bootstrap/README.md: KeePassXC group/entry structure, full workflow
  (generate → KeePassXC → bundle → shred → PI_ENCFILE post-deploy).
- .gitignore: add sso-mfa/bootstrap/secrets/, *.age, *.kdbx.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-03-02 09:01:50 +01:00

docs

feat(local-identity): Stage 4 — security hardening (NK-WP-0002-T04)

2026-03-02 08:06:56 +01:00

local-identity

refactor(local-identity): post-Stage4 cleanups and micro-fixes

2026-03-02 08:25:21 +01:00

sso-mfa/bootstrap

feat(sso-mfa): Phase 0a bootstrap tooling (NK-WP-0001-T01)

2026-03-02 09:01:50 +01:00

wiki

Add CLAUDE.md, wiki protoplans, and NK-WP-0001 workplan