Keychain
Set 3AM up once, and every other install of yours takes the same setup and stays in step. Enterprise and Strategic.
With a Keychain, you set 3AM up once, on one install: the home. Every other install, a member, takes the same connections, sign-in, policy and people from it, and stays in step. Change something on the home, and every member has it within a minute. Keychain comes with Enterprise and Strategic licences, and with trials.
What it carries
| Carried from the home | Never carried |
|---|---|
| Connections, and their secrets | The audit log: each install keeps its own |
| Sign-in: single sign-on and who may sign in | Incidents and their evidence |
| Mail, for sign-in codes | Sessions and the admin token |
| People and teams | Each install's own keys |
| Policy, autonomy and settings | The halt switch: stopping one install never stops another |
| Branding, business figures, estate corrections | |
| The licence, where it's good for that install |
The home can switch off any part under Keychain → What it carries. On a member, carried settings are read-only, marked managed by Keychain. Connections a member adds itself stay its own.
Set it up
Make one install the home
Usually production. In its console: Keychain → Make this the home.
Make a site key for the new site
Keychain → Add a site → A new host. Give the site a name, say what it's for, choose how long the key works (an hour to a week), and whether to add the site to the licence. The console shows one line to run, once.
Install the new site with it
On the new server, save the key and pass it to the installer:
printf '%s' '3AMSITE1.…' > site.key
./install.sh --keychain-join https://3am-prod.example.internal --keychain-site-key-file site.keyThe site installs, takes everything the Keychain carries within a minute, and joins the licence. Nobody types a code.
The home needs a console address the new site can reach (--console-url). Site keys work once, and expire.
Other ways to join
| Situation | How |
|---|---|
| 3AM is already running there | On the home, Add a site → An install already running → Open for 10 minutes. On the other install, Keychain → Join a Keychain → Pair. Each console shows six digits; type on each what the other shows |
| The site can't reach the home | On the home, Add a site → No network between them, choose a passphrase, and download the sealed file. Carry the file and the passphrase separately, then on the new site: ./install.sh --keychain 3am-keychain.json --keychain-passphrase-file pass.txt |
A sealed file is a one-time copy. It doesn't keep the site in step afterwards.
Day to day
- Change it on the home. Members take it at their next sync, every minute.
- Keep a member's own copy of a part: on the member, Keychain → Each part → Keep my own. The home's changes to that part stop arriving there.
- Leave the Keychain: the member keeps everything it has, editable again.
Owners and admins can change the Keychain. Everyone signed in can see it.
Moving the home
For new hardware or a datacentre move, hand the home to a member: on the home, Members → Make it the home. The home shows six digits for 10 minutes, and an owner or admin types them on the member. Every other member follows by itself.
The member must be in step, keep nothing of its own, and have a console address.
When an install is lost
| After | The Keychain shows |
|---|---|
| 3 minutes with no sync | Not answering |
| A day | Gone?, with Remove beside it |
| The home silent for 15 minutes | On members: If the home is gone, with Take over |
Nothing is removed by itself. If the home is truly lost, an owner on a member can take over as the home. Each other member then pairs with the new home, with six digits each.
Is it secure?
Everything travels encrypted, only between your own installs: 3AM's servers never see a connection, a secret or a person. Each install is identified by its own key, so pairing shows matching digits only if nothing sits between the two installs. Every algorithm is FIPS-approved.
Every Keychain action is in the audit log, under keychain.* and security.keychain_* events
(Audit events). The API is in the API reference.