The break-glass envelope

The envelope is the whole of your disaster plan on one sheet of paper. Nobody else holds a copy of these keys, which is the point of running this yourself, and also why losing the sheet and the disk together means the documents are gone.

What goes on it#

harbor break-glass prints all of it. By hand:

1. The passphrase that unlocks the data volume at boot.
2. The master key, which decrypts every document and every sealed secret, including the authenticator secrets and mail passwords: cat /data/secrets/kek
3. The backup password, which decrypts the snapshots: cat /data/secrets/restic-password
4. Where the backups are, and the credential that reaches them: the RESTIC_REPOSITORY line and the B2 key, the SFTP login, or which disk.
5. The address of Restore from a backup.

Where it goes#

In a safe, or with someone you trust in another house. Not on the box, and not in the vault.

When to reprint it#

Whenever any line changes: a new backup target, a rotated key, a new volume after a restore. A sheet that is out of date is the same as no sheet on the day it matters.