TazPod Gopass Migration
Summary
TazLab ha completato la migrazione da ~/secrets/ (vault AES-256-GCM + tmpfs + S3) a gopass (GPG-encrypted git store). Tutti i 13 progetti (10, 22-27) sono stati implementati e verificati. Solo il progetto 30 (Go core refactoring) rimane come Design Complete.
Old Architecture (superseded)
- vault.tar.aes su disco e S3
- AES-256-GCM decrypt in tmpfs ~/secrets/
- bind mount ~/secrets/.aws -> ~/.aws
- S3 sync daemon ogni 5 minuti
- comandi: unlock, lock, save, pull vault, push vault
New Architecture (gopass)
- gopass store in /workspace/tazlab-secrets (git repo)
- GPG encryption (Ed25519, key id F05AC4ED47F743C9B92EAB180EA9CA2C66572700)
- gpg-agent cache: default-cache-ttl 3600 (1 ora dall ultimo uso)
- secret access: gopass show diretto (nessun env var)
- secret write: gopass insert -f
- remote sync: git push/pull su github.com/tazzo/tazlab-secrets
- nessun demone, nessun tmpfs, nessun mount bind
GPG Keys
Le chiavi private GPG sono auto-contenute nel repo in gpg-keys/daily.asc (protette da passphrase). Su una macchina nuova: gpg –import gpg-keys/daily.asc -> gopass init –path /workspace/tazlab-secrets
Commands Removed
unlock, lock, save, pull vault, push vault, login, setup-storage, __internal_sync_daemon, __internal_env
Projects
- 10: bootstrap-secrets-gopass (create.sh) ✅
- 22: hermes agent scripts ✅
- 23: lxc storage scripts ✅
- 24: hetzner vault runtime ✅
- 25: tailscale setup ✅
- 26: tazpod-tailscale-up ✅
- 27: agents-ctx tools ✅
- 30: tazpod go core ✅ completato