SafeCall Docs

Appearance

Keryx / sourcectl secret store ​

Approved: 1 September 2026

This packet names the approved secret store and the durable evidence archive for Keryx for SafeCall (#114 OA-114-archive). Policy for what to back up lives in Android signing and iOS signing. This page is where files live and how to reach them.

#114 is closed (13 September 2026). Org / EU trader how-to: store-org-and-eu-trader.md. Apple Account Recovery remains #158. OA-114-archive is done (1 September 2026): share reachable from GLaDOS and MiniVan-3, evidence notes in evidence/keryx/, both Macs’ .p12 files in secrets/keryx/iOS/, unlock steps in nas-unlock.md.

Decision ​

ChoiceValue
HostExisting Proxmox CT 500 nas (Debian, privileged), 192.168.178.213
At restgocryptfs on /srv/sourcectl.cipher → mount /srv/sourcectl
AccessFile Browser (LAN HTTP) and SFTP to the same mount
UsersFile Browser users + Unix user sourcectl for SFTP
NetworkLAN only (192.168.178.0/24). No port forward, no public DNS
Daily loginsApple Passwords (unchanged)
Not this (now)Vaultwarden, Docker, a new LXC/VM, vault.sourcectl.com, Samba for secrets

Do not put .jks, .p12, .p8, or key.properties on Samba [public] or [builders]. Those shares stay for non-secret files; macOS discovery/mount failures are why secrets do not go there.

File Browser v2.63.23 is the last release; the project was archived 2026-09-01 (unmaintained). Use it only on the LAN, leave the command runner disabled, and prefer SFTP if you stop trusting the web UI later.

Honest limits: this is not travel-from-hotel access. After a NAS reboot you must unlock gocryptfs or File Browser/SFTP see an empty or missing root. A stolen disk without the gocryptfs passphrase is ciphertext.

Do not put passwords, keystores, .p12, .p8, or tokens in git, Slack, email, or ~/sourcectl/keryx-release-evidence/ (checksums only).

Layout on the unlocked mount ​

PathContents
/srv/sourcectl/secrets/keryx/android/upload-keystore.jks, key.properties
/srv/sourcectl/secrets/keryx/iOS/Apple Distribution .p12 (GLaDOS + MiniVan); APNs .p8 when it exists
/srv/sourcectl/secrets/keryx/ntfy/Host / username notes for the dual-run ntfy users (no tk_… or passwords)
/srv/sourcectl/secrets/keryx/firebase/Firebase Admin SDK JSON used as ntfy firebase-key-file (never git)
/srv/sourcectl/secrets/theseus/Production Theseus unlock PHC as unlock.hash (done 17 September 2026, 97 B). Passphrase in Apple Passwords, not this file
/srv/sourcectl/secrets/theseus/ops/Host / username / token-label notes (token_label_notes.txt, 17 September 2026). Token value in Apple Passwords, not git
/srv/sourcectl/secrets/theseus/android/Theseus upload upload-keystore.jks + key.properties (create in OA-AT-theseus-play)
/srv/sourcectl/secrets/theseus/iOS/Copy of the team Apple Distribution .p12 (same bytes as secrets/keryx/iOS/keryx-apple-distribution-glados-8P59575P2K.p12; do in OA-AT-theseus-apple)
/srv/sourcectl/secrets/ariadne/android/Ariadne upload upload-keystore.jks + key.properties (create in OA-AT-ariadne-play)
/srv/sourcectl/secrets/ariadne/iOS/Copy of the team Apple Distribution .p12 (same bytes as secrets/keryx/iOS/keryx-apple-distribution-glados-8P59575P2K.p12; do in OA-AT-ariadne-apple)
/srv/sourcectl/evidence/keryx/AAB/IPA checksum notes and filled release-record stubs (no secrets, no public-contact values)
/srv/sourcectl/evidence/ariadne-theseus/Secret-free lab host / Internal-track notes (no keystores, no QR photos)

~/sourcectl/keryx-release-evidence/ on the Macs may stay as a scratch copy.

1. FUSE on CT 500 ​

On the Proxmox host (once):

bash
pct set 500 -features fuse=1
pct reboot 500

Inside nas:

bash
apt-get update
apt-get install -y gocryptfs fuse
grep -q '^user_allow_other' /etc/fuse.conf \
  || echo user_allow_other >> /etc/fuse.conf

2. Encrypted directory ​

Still inside nas. Passphrase is not stored on disk and not in git.

bash
mkdir -p /srv/sourcectl.cipher /srv/sourcectl
chown root:root /srv/sourcectl.cipher
gocryptfs -init /srv/sourcectl.cipher
gocryptfs -allow_other /srv/sourcectl.cipher /srv/sourcectl
groupadd --force sourcectl
mkdir -p /srv/sourcectl/secrets /srv/sourcectl/evidence
chown -R root:sourcectl /srv/sourcectl
chmod 2770 /srv/sourcectl /srv/sourcectl/secrets /srv/sourcectl/evidence

After every NAS reboot, follow nas-unlock.md before starting File Browser. Do not put the passphrase in a world-readable script or in git.

3. File Browser (LAN web UI) ​

Last planned binary: GitHub filebrowser v2.63.23 (linux-amd64-filebrowser.tar.gz + checksums file). Verify SHA-256 before install.

bash
useradd --system --home /var/lib/filebrowser --shell /usr/sbin/nologin filebrowser
usermod -aG sourcectl filebrowser
mkdir -p /var/lib/filebrowser
# copy filebrowser binary to /usr/local/bin/filebrowser
chmod 755 /usr/local/bin/filebrowser
chown -R filebrowser:filebrowser /var/lib/filebrowser

Initialize config (run as root; then chown the db). Bind only the NAS LAN address. Leave exec/hooks disabled (default).

bash
filebrowser config init -d /var/lib/filebrowser/filebrowser.db
filebrowser config set -d /var/lib/filebrowser/filebrowser.db \
  --address 192.168.178.213 \
  --port 8080 \
  --root /srv/sourcectl
filebrowser users add sourcectl PLACEHOLDER --perm.admin \
  -d /var/lib/filebrowser/filebrowser.db
# replace PLACEHOLDER in the terminal only; do not record the password in git
# then change it in the web UI
chown filebrowser:filebrowser /var/lib/filebrowser/filebrowser.db

/etc/systemd/system/filebrowser.service:

ini
[Unit]
Description=File Browser (LAN secret store)
After=network.target
# Start only after you have unlocked gocryptfs (see §2)

[Service]
User=filebrowser
Group=filebrowser
ExecStart=/usr/local/bin/filebrowser -d /var/lib/filebrowser/filebrowser.db
Restart=on-failure

[Install]
WantedBy=multi-user.target
bash
systemctl daemon-reload
systemctl enable filebrowser.service
systemctl start filebrowser.service

From GLaDOS on LAN: http://192.168.178.213:8080 — not from the public internet. Optional nftables: accept tcp/8080 only from 192.168.178.0/24.

Add a second File Browser user without admin if MiniVan should not manage accounts.

4. SFTP fallback (Finder) ​

Same unlocked tree. Skip Samba.

bash
id sourcectl >/dev/null 2>&1 || useradd --home /srv/sourcectl --shell /usr/sbin/nologin sourcectl
usermod -aG sourcectl sourcectl
passwd sourcectl
# password not in git; keep 2770 group sourcectl on secrets/ and evidence/

sshd snippet (/etc/ssh/sshd_config.d/sourcectl-sftp.conf):

text
Match User sourcectl
    ForceCommand internal-sftp
    PasswordAuthentication yes
    AllowTcpForwarding no
    X11Forwarding no

systemctl reload ssh. From a Mac: Finder → Go → Connect to Server → sftp://192.168.178.213 as sourcectl. This user has no shell.

If sshd already listens on 0.0.0.0, restrict with the CT firewall: SSH from LAN only (you likely already do that for nas admin).

5. What to copy now ​

Into secrets/:

  • keryx/android/upload-keystore.jks + store password + key password + alias upload (password in a small sidecar text file only on the share, never git)
  • keryx/android/key.properties
  • GLaDOS Apple Distribution .p12 (recreate Distribution in Xcode if Keychain only shows Developer ID — that is the wrong identity) named keryx-apple-distribution-glados-8P59575P2K.p12 plus export password
  • MiniVan .p12 as keryx-apple-distribution-minivan-8P59575P2K.p12
  • SSH keys that must survive GLaDOS (e.g. gitlab_sourcectl), not a zip of ~/.ssh
  • APNs .p8 when it exists (OA-110-apns-p8)

Into evidence/: copy ~/sourcectl/keryx-release-evidence/*.txt.

Confirm git check-ignore still lists key.properties and the .jks. Never git add them.

6. Close bars ​

Log rowStatus (1 September 2026)
OA-114-archiveDone. Unlock: nas-unlock.md. File Browser from GLaDOS and MiniVan-3. evidence/keryx/ populated.
OA-110-cert-backupDone. Both Macs’ Apple Distribution .p12 in secrets/keryx/iOS/.
#114Closed 13 September 2026. Residual Apple Account Recovery is #158.

Later (not this phase) ​

A self-hosted password manager (Vaultwarden) behind vault.sourcectl.com can wait until there is a larger server and time. Do not start that LXC while Keryx signing files only need this NAS directory.