pinning + new version of backups

2026-07-30 14:03:16 -05:00
parent 477b9a5353
commit 2669ab1388
32 changed files with 1527 additions and 133 deletions
@@ -12,6 +12,11 @@ OVERLORD_SERVER=wss://your-server.com:5173
 # OVERLORD_TLS_CA=./certs/server.crt
 OVERLORD_TLS_INSECURE_SKIP_VERIFY=false

+# Stronger server identity verification (recommended). Comma-separate the
+# current and next SHA-256 SPKI pins during certificate-key rotation.
+# Generated agents receive the active in-process server pin automatically.
+# OVERLORD_TLS_SPKI_PINS=base64-sha256-current,base64-sha256-next
+
 # Client certificate for mutual TLS (optional, advanced)
 # OVERLORD_TLS_CLIENT_CERT=./certs/client.crt
 # OVERLORD_TLS_CLIENT_KEY=./certs/client.key