From 115435ec54724bac09bd9b266b844a10f8a3017e Mon Sep 17 00:00:00 2001 From: benvin Date: Wed, 29 Jul 2026 20:23:18 +1000 Subject: [PATCH] Add logarchive gpg key logarchiver encrypts archived logs to an OpenPGP key held in the gpg engine so the private key never leaves Vault; retrieval delegates decryption back to gpg/decrypt/logarchive. The service consumes only the public key, delivered to the logging namespace as a mounted file via VSO from KV (existing logging/default policy), so no new Vault role or read policy is needed here. - Create gpg key logarchive (rsa-4096, non-exportable) in the gpg mount. Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv --- config/gpg_key/gpg/logarchive.yaml | 8 ++++++++ 1 file changed, 8 insertions(+) create mode 100644 config/gpg_key/gpg/logarchive.yaml diff --git a/config/gpg_key/gpg/logarchive.yaml b/config/gpg_key/gpg/logarchive.yaml new file mode 100644 index 0000000..a39f961 --- /dev/null +++ b/config/gpg_key/gpg/logarchive.yaml @@ -0,0 +1,8 @@ +# config/gpg_key/gpg/logarchive.yaml +# OpenPGP key in the gpg engine for the logarchiver service. The private key +# stays in Vault; logarchiver reads only the exported public key +# (gpg/keys/logarchive) to encrypt archived logs, and retrieval delegates +# decryption back to gpg/decrypt/logarchive. Key name = "logarchive", backend = "gpg". +algorithm: rsa-4096 +identity: "logarchive " +exportable: false