External backups and retired provider

Enclavr no longer installs, authenticates, reads, writes, or falls back to 1Password. This page retains its old URL so existing links explain the current boundary instead of leading to obsolete bootstrap or recovery instructions.

configr_secret_store_provider=1password is rejected. Normal runs, standalone Ubuntu/Kali bootstrap, namespace repair, and QA use OpenBao. The logical op:// reference syntax is retained and resolved by OpenBao; it does not select an external provider.

Operator-managed backups

The operator supplies protected .env-mwc-openbao JSON containing the existing cluster identity, seal, TLS material, and recovery share. They may manually back it up outside Enclavr using their chosen backup service. Enclavr does not sign in to, synchronize, or retrieve that external backup.

Each voter receives only minimal config/seal.json containing its namespace and existing pinned seal. Recovery shares and CA signing keys remain operator-only. A missing file or failed lookup must never cause replacement seal generation, cluster initialization, or identity rotation.

For current procedures, use host enrollment, OpenBao custody, the operations runbook, and the isolated restore exercise.