Scooby HuskyandClaude Sonnet 5 e2bdab8940 Fix vault-restore: authenticate raft snapshot restore with a real token ...

raft snapshot restore is a privileged operation - unsealing alone isn't
enough, it needs an authenticated token. Missed this on first pass, caught
live: 'Code: 403. Errors: * permission denied'.

First run: uses the throwaway init's own fresh root token. Steady state
(already restored at least once): uses a copy of home's real root token,
which becomes valid on this Vault the moment the first restore completes
(its auth data becomes byte-for-byte home's as of that snapshot). Stored
the same way as the unseal key - kubectl directly on the VPS, not git.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

2026-08-17 21:46:23 -05:00

..

manifests

Fix vault-restore: authenticate raft snapshot restore with a real token

2026-08-17 21:46:23 -05:00

values.yaml

Phase 2: deploy Vault warm standby on the VPS

2026-08-17 21:42:09 -05:00