pal-e-docs

TODO: GPG Physical Backup

todo-gpg-physical-backup Todo

open todo
Project

TODO: GPG Physical Backup

What

Create a physical backup of the Salt master GPG private key. This is the single point of failure for the entire secret trust chain. If this key is lost and the NVMe dies, all GPG-encrypted pillar data is permanently unrecoverable.

Key Details

Property Value
Fingerprint <code>EE61A629AA7138A75AEF783481A03D1CF874DC90</code>
Key ID <code>81A03D1CF874DC90</code>
Identity Salt Master (pal-e-platform) &lt;salt@pal-e.local&gt;
Algorithm RSA 4096, no passphrase, no expiry
Keyring locations <code>/home/ldraney/.gnupg/</code> (user) + <code>/etc/salt/gpgkeys/</code> (Salt master)

Steps

  • Export private key: gpg --export-secret-keys --armor 81A03D1CF874DC90 > /tmp/salt-master-gpg.asc
  • Paper backup: print the ASCII-armored key, store in a safe or fireproof box
  • Encrypted USB: copy to an encrypted USB drive, store separately from the paper backup
  • MinIO backup (optional): encrypt with a passphrase and upload to MinIO — but note this is on the same host, so it doesn't survive NVMe failure
  • Verify: import the key on a test keyring and decrypt a test pillar value
  • Record backup location and verification date in secrets_registry.sls
  • Shred the temp file: shred -u /tmp/salt-master-gpg.asc

Priority

Medium-high. The key only needs to survive until off-host backups exist, but if the NVMe fails before that, all encrypted pillar data is lost. This is cheap insurance.

Origin

Deferred Step 8 from plan-2026-02-26-salt-host-management Phase 2b, then redistributed when Phase 4 was deferred (2026-02-28).
  • plan-2026-02-26-salt-host-management — source plan (completed)