Human Identity and Workload Identity Should Not Share an Auth Method
OIDC fits interactive operators; AppRole fits non-interactive services. Combining them weakens both lifecycle models.
TOPIC
Security & Identity
Lessons, explainers, experiments, and implementation notes.
Two OpenBao Services on One Host Are Still Not High Availability
Separating the main secret authority from the Transit seal service improves trust boundaries, but both still share the same physical host failure domain.
The TOTP QR Code Is a Secret-Enrollment Ceremony
Scanning the QR code transfers long-lived secret material; it should be treated more carefully than an ordinary setup screen.
Cookie Domain and SameSite Policy Are Part of Cross-Subdomain SSO
One identity portal can protect many subdomains only if browser cookie scope and request behavior match the intended trust boundary.
KV v2 Turns Secret Rotation into a Versioned State Transition
Keeping versions makes rotation and rollback explicit instead of overwriting the only known credential value.
Tailscale SSH and Ordinary SSH over Tailscale Are Two Different Models
I can send SSH packets over the tailnet without asking Tailscale to become the SSH authentication system.
Anonymous Monitoring Probes Do Not Prove a Human Session Is Broken
Synthetic health checks normally have no browser cookie, so anonymous AuthRequest logs can be completely healthy behavior.
A Secret Manager Is an Authorization System, Not Just Encrypted .env
OpenBao adds identity, policy, versioning, leases and audit around secrets instead of merely moving plaintext to a different file.
Static Auto-Unseal Is a Temporary Root of Trust, Not HA
The same-host seal service removes manual unseal entry, but its static key remains a temporary bootstrap root of trust on the same failure domain.
Path-Based Policies Make Least Privilege Concrete
The difference between operator, runtime and backup identities is visible in the exact OpenBao paths and capabilities they receive.
Session Inactivity, Expiration and Remember Me Solve Different Problems
A session can have an idle timeout, a hard lifetime and a trusted-browser persistence policy at the same time.
Clock Synchronization Is Part of the Authentication System
A correct TOTP secret can still fail when the verifier and authenticator disagree about time.
MFA Recovery Is Not the Same Problem as Password Reset
Losing the authenticator device creates a second-factor recovery problem that should not silently collapse to the password path.
What a 30-Second TOTP Window Actually Means
TOTP is not a random six-digit number every half minute; it is a deterministic moving-factor calculation with a strict verifier window.
Why Authelia-to-OpenBao OIDC Is a Separate Phase
Human federation should be added after the secret authority is stable, not mixed into the initial bootstrap trust ceremony.
Google Authenticator Is a TOTP Client, Not the Authentication Server
The six-digit code comes from a shared TOTP secret and time step; Google Authenticator is only one compatible client.
A Phone Number Is a Communication Address, Not a Complete Identity
We often treat a phone number as if it were a permanent identity. In reality, it is a communication address whose user can change, whose access can be lost, and whose presentation can be misleading.
AppRole Is Machine Identity, Not a Shared Master Password
Workloads should authenticate to the secret authority with narrow machine identities rather than one credential copied across services.
Redis and PostgreSQL Have Different Jobs in the Authelia Stack
Persistent SSO works better when ephemeral session state and durable identity-provider state are not confused.
I Treat Tailscale Access Policy as Infrastructure Code
Once the tailnet becomes a real operational network, who can reach which host and service should not live only in memory.
Two-Factor Policy Belongs at the Shared Access Boundary
Putting MFA in front of each application separately creates duplicated policy; Authelia gives the protected subdomains one identity boundary.
TLS Key Custody Is Part of the OpenBao Root of Trust
The server needs its TLS private key to operate, while the CA private key is more powerful and should remain off-host.
Audit Logs Matter Because Secret Reads Are Security Events
A successful secret request is operationally normal and still important enough to leave durable evidence.