The registry-token example's shown grep command didn't actually
reproduce the shown output (it matched the first 'service: automation'
entry, gitea, not registry-token). Fixed to grep on the registry-token
path directly, so the command is genuinely reproducible. Re-verified
everything else live: SSH cert flow's 2h timer, the technitium API
token lookup snippet, and the flow diagram - all accurate.
Two command-block "evidence" snippets added earlier today pasted real,
live-captured values verbatim: the exact cert file path, the fleet's
actual CA fingerprint, today's real issuance timestamp, and the live
Vault role/principal name. All of it identified real infrastructure
in a way the rest of this repo's established redaction convention
(see docs/firewall-and-network.md's [admin workstation]-style
placeholders) already exists specifically to avoid. Redacted to
bracket placeholders; the structural/format evidence (cert type,
extensions, TTLs) stays genuine.
Vault's ssh-client-signer mount was undocumented here entirely. Adds it
as flow 2/5 rather than merging into Certificate Flow, since the actual
mechanism differs (own systemd timer, bypasses Vault Agent's render
cycle, only reuses its cached token) - and explains why that distinction
matters for debugging. Diagram updated to match: a third data-plane box
feeding fleet-wide sshd trust instead of a container.
Step 5 re-audit. Both verified live earlier this session but never
shown: the registry-token shared template entry (proves the shared-
path mechanism), and the technitium_api_token lookup (proves the
flagged admin/runtime-split exception with the actual Jinja syntax).
Source Trilium note (Secret Distribution Model) was live-verified and
stamped this session - Certificate Flow, App Secret Flow, Configuration
Distribution Flow, and the technitium_api_token Vault-KV exception all
confirmed against the real hosts, not just trusted from the KB.
Replaced the Mermaid diagram, which incorrectly showed the Configuration
Distribution Flow feeding into Vault directly, with a corrected version:
that flow is a control-plane gate on what Vault Agent renders, not a
peer data flow. Added a real Vault Agent log excerpt proving the full
redeploy chain (restart -> render -> reload_command -> container
recreated) actually happens, and restored the technitium_api_token
exception that was in the source note but missing from this doc.
Names real technology throughout (Vault, Authentik, pfSense,
firewalld, Wazuh) instead of staying generic, adds a 'why this
approach vs the alternative' section to every doc, cross-links
heavily between docs instead of treating each system in isolation.
Mermaid diagrams up front, GFM alert callouts for key decisions and
gotchas, tables instead of bullet walls - replaces plain prose with
the visual template established for security-monitoring.md.
Secrets & PKI, Secret Distribution Model, SSO & Identity,
Firewall & Network Segmentation, DNS Naming Model, and Security
Monitoring - the first batch of per-system write-ups linked from
the new README, sourced and sanitized from the internal KB.
automation-bot
thesabear