Where State Lives — Operator training

Twelve roles, many containers — so where, exactly, is the data? In one place. PostgreSQL is the online system of record for configuration versions, requests, certificate inventory, revocations, audit leaves, controller state and constant-time CA statistics. Every service role is stateless; the database is the single stateful component, and it rides standard PostgreSQL HA.

It is intentionally not replaceable by SQLite, and the reason is not taste: transactional advisory locks, append-only triggers, JSON predicates, the audit chain and SKIP LOCKED coordination are correctness mechanisms, not conveniences. Leader election, "two replicas must not do this twice", and the tamper-evident audit log all lean on them.

One deliberate exception proves the rule: the offline-root kit (a designed, not yet built deployment shape) has no store dependency at all — its state is one signed, encrypted bundle carried between ceremonies.

Metaphor: the processes are clerks; the database is the filing room. Fire a clerk mid-shift and nothing is lost — the file was never in his pocket.

Where it breaks: one thing is deliberately not in the filing room — the master secret that unwraps software-custody keys. A stolen filing room without it is inert.

That completes the tour of what you're running. The root and issuing CA you created in First Run live in that same filing room — and the next section, CAs & Hierarchy, opens by reading them as what they really are.

Now I can point at the one place my CA's state lives.