amadan

carlos / platform Public

infra: stage Kass secrets-copy script in the operator queue

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Paul Campbell 6d5f1176fced4d9e0e120e2d4991bbf82218f892 parent 67c944f
4 files changed, +72 −1
  • infra/flagship/.terraform.lock.hcl +39 −0
  • infra/flagship/README.md +10 −1
  • infra/flagship/plan.out binary
  • infra/flagship/scripts/copy-kass-secrets.sh +23 −0
diff --git a/infra/flagship/.terraform.lock.hcl b/infra/flagship/.terraform.lock.hcl
new file mode 100644
index 000000000..ab67445ee
--- /dev/null
+++ b/infra/flagship/.terraform.lock.hcl
@@ -0,0 +1,39 @@
+# This file is maintained automatically by "tofu init".
+# Manual edits may be lost in future updates.
+
+provider "registry.opentofu.org/hashicorp/aws" {
+ version = "6.57.1"
+ constraints = "~> 6.0"
+ hashes = [
+ "h1:8wbrCS3R5lunN2HMVfQ+oMB3uFVAO7gfUbItdZa+tdA=",
+ "h1:C4XEcAWUKXExKCF6NhvMxkSyZ/JqNWjtwtwwEqQtl70=",
+ "h1:Fah+p3BD+/E7wdgazQFp4fsjuvTh5/Q7fQFyMsv9juM=",
+ "h1:S6eLURiAh6L00nr+9s2zwuhHQOU04rEG60Z9xO1ORRM=",
+ "h1:UdllVJ4482tLgz5q8se3SPzpPoXuFXwvxiykpgdipWs=",
+ "h1:ZAkIIdmQryKnldenUI2fqThlAciNz2UYKVTZ5F/57ME=",
+ "h1:a/i6TVZX4jSNSvHIWWTqLIlaugg7SYfQMZNVtzDWlKM=",
+ "h1:gGtYen1GfQvynKT8lHguY+cvmxNww+TOqCaapWoNW1w=",
+ "h1:iFr4+F/b94MEadHCiaNm6o6TapyvLT6TrwmbPyDQs9E=",
+ "h1:k0OzZI0aBgeEhCUcoK00/6C3hBK59ETo7g5Jq62wRqQ=",
+ "h1:nlvu+qO8eMFdnMptYSUK1c5dOXoK6r3HG87jzE7EYvQ=",
+ "h1:rVP8Z9tc37nwsW+NLSvEQyUBoDG/zsMtPSMeHhBrR3k=",
+ "h1:rxnmHWTUE2Aou/otNocOI4Rvcm69LQsoNYssj0s7hIo=",
+ "h1:va0Q0eDSt7xyvkSX7GbXmAO/QUqugZb/05gMdcQlR0I=",
+ "h1:yXF1EzUTMepZv4SeQnBNUvjOj2HKEKSl+jVndIKksGU=",
+ "zh:053910cce06bba506fb7a3dcecdcd719280d7df8b8a7cce06ae3e2dd20b1cc0d",
+ "zh:14feabeefef742b528c978a78f6896240a7ca3464a4714a5b1e1b2d448db4fd5",
+ "zh:22dd549e3c479b2ff2121e00a005aa3b6b43a166e727ef3208a529a59feb1608",
+ "zh:3ca5eab63ac77da335d42ebe0af8569c5c617dc5b239750b111f5ba9f2f889cd",
+ "zh:3d686f9fca9752850958a353971cd7eb1f5a48e55c2c56fcd96d18cc6e54f8ae",
+ "zh:512e46d35abfec0ba85fc0f2da7dc39fece9106f02165e95096b6549f920453a",
+ "zh:5fe83903b4bef5b7318de4b61e0ff9c88aa8ac42b7abeae83d1599cb054b0908",
+ "zh:61ec8a18a7270e28f43c0f810c82a147af7a5de622eb1f243c3a773e234b2172",
+ "zh:6428cd62e615ccaaa3a26a22f68a84f80a0d497a04f0405648119ef69e709ff9",
+ "zh:776e57bb2c94716f452eea5803c90b97d304c9f343e6746780a255d8217b95f9",
+ "zh:99bacf79ce92568d086ed62b287d9b77fa0c4e86a6c25ad398bec04ea0e44897",
+ "zh:b4361d4ad5074df3e83dc0e40452b63f231ae5959b4007763739d3a02caffe29",
+ "zh:d96c0f8603a1f8ab61c633a7a707922313f6bdfa8d17fa21d9ccf103fade6af7",
+ "zh:edfd955636489371e5ad1f40fc77a023d7eb7d09140342b151f0ea15451ef41b",
+ "zh:eeb03674754bd059fafa62b58cf4015c2c07bc25477def3c64eef487d583a63c",
+ ]
+}
diff --git a/infra/flagship/README.md b/infra/flagship/README.md
index 3e564ab09..155f06845 100644
--- a/infra/flagship/README.md
+++ b/infra/flagship/README.md
@@ -24,7 +24,16 @@ AWS account **271376211898** (adopted from Keymail, spec §12), profile
cd infra/flagship && DNSIMPLE_TOKEN=... tofu apply
```
-3. **Root email re-home** (whenever): move this account's root email to a
+3. **Copy Kass's secrets** (blocked for the agent — credential material):
+
+ ```
+ bash infra/flagship/scripts/copy-kass-secrets.sh
+ ```
+
+ Copies both peppers + prod SMTP creds to `/carlos/kass/...` in
+ 271376211898, byte-verifying each. Values are never printed.
+
+4. **Root email re-home** (whenever): move this account's root email to a
carlosframework.com / carlosplatform.com address (spec §12).
## Kass cutover go/no-go checklist (Plan B task B6)
diff --git a/infra/flagship/plan.out b/infra/flagship/plan.out
new file mode 100644
index 000000000..57050db9a
Binary files /dev/null and b/infra/flagship/plan.out differ
diff --git a/infra/flagship/scripts/copy-kass-secrets.sh b/infra/flagship/scripts/copy-kass-secrets.sh
new file mode 100755
index 000000000..5e2a6724d
--- /dev/null
+++ b/infra/flagship/scripts/copy-kass-secrets.sh
@@ -0,0 +1,23 @@
+#!/bin/bash
+# 🤖 B4 step 1: copy Kass's irreplaceable SSM parameters into the flagship
+# account, byte-verifying each. The peppers are the single point of data
+# loss for the whole Kass migration — restoring a registry without the
+# original pepper orphans every account, by design, with no recovery path.
+# Values never touch disk or the terminal; only OK/MISMATCH is printed.
+set -euo pipefail
+
+for p in /kass/prod/pepper /kass/devbox/pepper /kass/prod/smtp-user /kass/prod/smtp-pass; do
+ v=$(aws --profile kass ssm get-parameter --name "$p" --with-decryption \
+ --query Parameter.Value --output text)
+ aws --profile keymail ssm put-parameter --name "/carlos$p" \
+ --type SecureString --value "$v" --overwrite >/dev/null
+ n=$(aws --profile keymail ssm get-parameter --name "/carlos$p" \
+ --with-decryption --query Parameter.Value --output text)
+ if [ "$v" = "$n" ]; then
+ echo "/carlos$p OK (byte-verified)"
+ else
+ echo "/carlos$p MISMATCH — STOP, do not proceed with migration" >&2
+ exit 1
+ fi
+done
+echo "all secrets copied and verified"