|
| 1 | +# Operational features |
| 2 | + |
| 3 | +Phase G's ops suite adds five operational capabilities: an audit log, 2FA / |
| 4 | +group gating, opt-in telemetry, scheduled backups, and an SSH tunnel helper. |
| 5 | +The first three share one interception point in the app layer (`guardedOp`), |
| 6 | +which wraps the destructive verbs (backup, restore, sync, prune) exactly once. |
| 7 | + |
| 8 | +## Table of contents |
| 9 | + |
| 10 | +- [Audit log](#audit-log) |
| 11 | +- [2FA & group gating](#2fa--group-gating) |
| 12 | +- [Telemetry](#telemetry) |
| 13 | +- [Scheduled backups](#scheduled-backups) |
| 14 | +- [SSH tunnel](#ssh-tunnel) |
| 15 | + |
| 16 | +## Audit log |
| 17 | + |
| 18 | +An append-only JSONL trail of destructive operations — who ran what, against |
| 19 | +which profile, when, and the outcome. Off by default. |
| 20 | + |
| 21 | +```yaml |
| 22 | +audit: |
| 23 | + enabled: true |
| 24 | + path: ~/.local/state/siphon/audit.log # optional; this is the default |
| 25 | +``` |
| 26 | +
|
| 27 | +Each line records `time`, `op`, `profile`, `target`, `actor` (OS user), |
| 28 | +`outcome` (`ok`/`error`), `error`, and `duration_ms`. Audit writes are |
| 29 | +best-effort: a failure to write the log never fails the operation it records. |
| 30 | + |
| 31 | +## 2FA & group gating |
| 32 | + |
| 33 | +A profile belongs to a **group**; a group can require a second deliberate step |
| 34 | +before any destructive op on its profiles: |
| 35 | + |
| 36 | +```yaml |
| 37 | +groups: |
| 38 | + critical: |
| 39 | + confirm_destructive: true # operator must retype the profile name |
| 40 | + require_2fa: true # operator must enter a current TOTP code |
| 41 | + totp_secret: env:SIPHON_PROD_TOTP # base32 RFC-6238 secret (a secret-ref) |
| 42 | +
|
| 43 | +profiles: |
| 44 | + prod: |
| 45 | + driver: postgres |
| 46 | + group: critical |
| 47 | + # ... |
| 48 | +``` |
| 49 | + |
| 50 | +`confirm_destructive` prompts the operator to retype the profile name; |
| 51 | +`require_2fa` prompts for a 6-digit TOTP verified (with ±1 step skew) against the |
| 52 | +group's `totp_secret` — the same code your authenticator app shows. The check |
| 53 | +runs **before** the operation, so a failed confirmation aborts before any |
| 54 | +destructive work. `require_2fa` with no resolvable secret fails closed. The TOTP |
| 55 | +secret is a secret-ref, so the plaintext never lives in config. |
| 56 | + |
| 57 | +This is offline by design — siphon is a local CLI, so "2FA" means a TOTP |
| 58 | +(standard, no network) rather than a push notification. |
| 59 | + |
| 60 | +## Telemetry |
| 61 | + |
| 62 | +Opt-in aggregate operational metrics: per-op counts and error tallies, flushed |
| 63 | +as JSON. Off by default. |
| 64 | + |
| 65 | +```yaml |
| 66 | +telemetry: |
| 67 | + enabled: true |
| 68 | + path: ~/.local/state/siphon/telemetry.json # optional; this is the default |
| 69 | +``` |
| 70 | + |
| 71 | +Telemetry records **only** the operation name and outcome — never profile names, |
| 72 | +hosts, dump IDs, the actor, or any data. It is composed onto the audit seam, so |
| 73 | +enabling it adds no new interception in the verbs. |
| 74 | + |
| 75 | +## Scheduled backups |
| 76 | + |
| 77 | +`siphon schedule` manages recurring backups by maintaining a delimited, |
| 78 | +siphon-owned block in your **crontab** — siphon does not run a scheduler daemon; |
| 79 | +your system's cron invokes `siphon backup <profile>` on the schedule. |
| 80 | + |
| 81 | +```bash |
| 82 | +siphon schedule add prod --cron "0 2 * * *" # nightly at 02:00 |
| 83 | +siphon schedule list |
| 84 | +siphon schedule remove prod |
| 85 | +``` |
| 86 | + |
| 87 | +Entries outside the siphon-managed block are preserved. Re-adding a profile |
| 88 | +updates its schedule in place; removing the last entry drops the managed block. |
| 89 | +Requires the `crontab` command. |
| 90 | + |
| 91 | +## SSH tunnel |
| 92 | + |
| 93 | +`siphon tunnel <profile>` opens an SSH local-forward to a profile's database |
| 94 | +through a configured bastion, using your **system ssh client** (your ssh config, |
| 95 | +keys, and agent all apply). It runs in the foreground and holds the tunnel open |
| 96 | +until you press Ctrl-C. |
| 97 | + |
| 98 | +```yaml |
| 99 | +profiles: |
| 100 | + prod: |
| 101 | + driver: postgres |
| 102 | + host: db.internal |
| 103 | + port: 5432 |
| 104 | + tunnel: |
| 105 | + bastion: jump@bastion.example.com |
| 106 | + local_port: 15432 # optional; defaults to the DB port |
| 107 | +``` |
| 108 | + |
| 109 | +```bash |
| 110 | +siphon tunnel prod |
| 111 | +# tunnel open: localhost:15432 → db.internal:5432 via jump@bastion.example.com (Ctrl-C to close) |
| 112 | +``` |
| 113 | + |
| 114 | +Run it in one terminal and point a client (or another siphon command) at the |
| 115 | +printed local address in another. siphon delegates to `ssh -L` rather than |
| 116 | +reimplementing SSH or holding a connection in a daemon. |
0 commit comments