Operations: production keys
Production keys
Section titled “Production keys”Every service ships in dev mode: deterministic seeds derive the keyrings so transcripts and demos are reproducible. Production is the same binaries with real entropy in the environment, with no code path changes, only configuration.
The key surface per service
Section titled “The key surface per service”| Service | Key material (env) | What it protects |
|---|---|---|
| registry | UNIDPP_REGISTRY_ADMIN_TOKEN |
mutations (items, bindings) |
| trust | UNIDPP_TRUST_SIGN_SEED (Ed25519), UNIDPP_TRUST_SIGN_SEED_P256, UNIDPP_TRUST_ADMIN_TOKEN |
response signing in the tree-head domain; the pinned pack anchor; mutations |
| log | UNIDPP_LOG_SEED, UNIDPP_LOG_SUITE, UNIDPP_LOG_APPEND_TOKEN |
receipt signing; who may append commitments |
| issuer | UNIDPP_ISSUER_EVENT_SEED (Ed25519), UNIDPP_ISSUER_PACK_SEED (P-256/SM2 per UNIDPP_ISSUER_PACK_SUITE), UNIDPP_ISSUER_ADMIN_TOKEN |
event signatures; Tier-A pack signatures |
| gateway | — (stateless renders) | — |
| archive | UNIDPP_ARCHIVE_SIGN_SEED, UNIDPP_ARCHIVE_ADMIN_TOKEN |
snapshot notarization |
| console | UNIDPP_CONSOLE_ADMIN_TOKEN |
the admin session login |
Secrets in manifests are ${VAR} references, and unidpp-config
substitutes them from the environment at render time, and the console
renders them sealed (never resolved). A manifest in git is therefore
publishable; the .env it references is not.
The rotation ceremony
Section titled “The rotation ceremony”- Generate the new key material out of band (e.g. 32 bytes of
real entropy per seed) and stage it in the deployment’s
.env. - Backup first: the durability contract covers the state that predates the rotation (Backups and restore drills).
- Restart the service; its journal replays under the new key for signing NEW acts. Events already sealed keep their signatures — verification is as-of, so history stays verifiable under the OLD anchors.
- Re-pin the anchors: verifiers pin the trust service’s
GET /keyring; supersession is a trust-graph act (register the new key, declare the old one superseded; see the trust API reference). Retroactive distrust of an authority requires a quorate attestation; key supersession does not. - Drill the verify path: mint a pack under the new keys and verify it against the re-pinned anchors.
What dev seeds are for
Section titled “What dev seeds are for”Deterministic seeds make the reference stack reproducible: the same seed → the same public anchors → the same transcripts. They are published in the demo program’s source on purpose. Never reuse them where a real duty attaches.