Tarsnap and security about sovereign HOT 6 CLOSED

@Aleksandyr I agree that 2 is a better solution. Please do submit a pull request for it. Thanks!

from sovereign.

And even better solution, though maybe not as easy to implement using ansible, would be to generate a write only key for tarsnap and move the full key to another server. Leaving the Sovereign server only able to write backups.

from sovereign.

@abl & @sloped: Have either of you had any luck with this? If you've got it working, please submit a PR.

from sovereign.

Oh. Yes, it was a pretty trivial fix (although I didn't fix the playbooks, and my server is on an ancient-ish revision of Sovereign and needs to be taken down and rebuilt.)

I'll have to get employer permission to submit a PR; may be awhile before I fire it up.

from sovereign.

@abl: can we expect a PR, or should we work on this ourselves? Thanks.

from sovereign.

@al3x - still waiting on employer approval :( I promise it was a really quick fix, however, so I'd say to just go ahead with it.

from sovereign.