Context for the uninitialized:
I am yet to do my first PDS migration on main outside of Bluesky’s mushroom-named PDS (or @recaptime.dev in the matter of Tranquil instance for delegated accounts), but does any PDS operators has practiced disaster planning involving losing PLC keys altogether or worse broken DID documents in the PLC directory? I sought advice to Claude (link to chat thread if you need, feel free to DM me regarding gifting me Claude Pro sub as a Google AI Pro student trial subscriber) on planning on how to do so, but I need advice from humans as a future PDS operator too.
It took a moment to look up, but basically the protocol documentation recommends keeping a second rotation key (ideally offline) for disaster recovery: Going to production - AT Protocol
I don’t know which order the reference PDS registers these, but in theory the ‘PDS_RECOVERY_DID_KEY’ should have higher priority (lower index) in case the ‘PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX’ gets breached.
To my knowledge, all large PDS providers except W Social do this in some way. Personally, I’d split the recovery key among trusted parties and/or places (with a certain quorum needed to recover it).
That said, I think that for the eventual cooperative migration flow, there should be some plausibility checks of the new DID document as part of the process, performed by the releasing PDS. I assume that would involve checking whether the declared PDS is reachable, and maybe the opt-outable addition of a rotation key held by the original PDS for a custodial revert option.
(I don’t have it on hand, but I think there’s an early thread here somewhere to discuss this feature.)
I don’t have direct experience with goat, so I don’t know which plausibility checks it performs. I don’t think it’s ever possible to fully validate the destination PDS though, so keeping a recovery key on hand independently from it is important.
1 Like
The TLDR is basically: store the secret keys you use in the PDS setup in some sort of durable storage, i.e., copy them into your password manager. If you loose both PDS_RECOVERY_DID_KEY and PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX you are indeed hosed.
Also, have backups of your server, even if they’re just full disk snapshots. Keep those backups after you tear down a server in case you need to fix something.
2 Likes