Add logarchive gpg key

logarchiver encrypts archived logs to an OpenPGP key held in the gpg engine so the private key never leaves Vault; retrieval delegates decryption back to gpg/decrypt/logarchive. The service consumes only the public key, delivered to the logging namespace as a mounted file via VSO from KV (existing logging/default policy), so no new Vault role or read policy is needed here. - Create gpg key logarchive (rsa-4096, non-exportable) in the gpg mount. Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
2026-07-29 20:23:18 +10:00
parent 31f32aba0f
commit 115435ec54
1 changed files with 8 additions and 0 deletions
@@ -0,0 +1,8 @@
+# config/gpg_key/gpg/logarchive.yaml
+# OpenPGP key in the gpg engine for the logarchiver service. The private key
+# stays in Vault; logarchiver reads only the exported public key
+# (gpg/keys/logarchive) to encrypt archived logs, and retrieval delegates
+# decryption back to gpg/decrypt/logarchive. Key name = "logarchive", backend = "gpg".
+algorithm: rsa-4096
+identity: "logarchive <logarchive@unkin.net>"
+exportable: false