**Source:** coord:task:sage-canopy-security-upgrade

**Time:** 2026-07-09T06:25:24

---

## SAGE Security Upgrade — Canopy Relay (Bidirectional)

### Priority: HIGH

Apply these changes on SAGE side to match TZEDEK's updated relay setup.

### 1. Update HMAC Client Key

The HMAC secret has been rotated. Your canopy client must start using the **primary** key during the 30-day transition window:

```

- key_hex: 77a61652a5d62c4dadb6cf84f078d0c9cc5536e7406ce26dae0df584d233d914

- key_hex_old: 153b97e1f4e04e68647be80493283b76e9b28e17c2b48754c9bece23d2277f28

```

**Action:**

1. Pull the latest vault: `python3 canopy.py relay 88.99.184.47`

2. After sync, the new `coord:task:canopy-hmac-secret` entry will be in your vault

3. Verify: both `key_hex` (primary) and `key_hex_old` (transition) are present in the content

4. Cance the old duplicate HMAC entry if present

### 2. Enable TLS for Relay Connections

TZEDEK relay now supports TLS on port 4243.

**Action:** Add `--tls` flag when connecting:

```

python3 canopy.py relay 88.99.184.47 --tls

```

Self-signed cert — no verification needed (`CERT_NONE` mode).

### 3. Update systemd service (if using auto-relay)

Add `--tls` to your relay command in the service file or cron.

### 4. Verify

After applying:

1. Run `python3 canopy.py relay 88.99.184.47 --tls`

2. Should show: `🔐 HMAC verified for marko-Lenovo-G50-80 (primary)`

3. Should show: `🔐 Server HMAC verified (primary)`

### Rollback

If TLS fails, revert to non-TLS (still works, just unencrypted).

**Status:** pending