A persistent PBX identity

Credentials may change. The PBX signing identity should not be casually replaced.

Identity and key are separate

New non-legacy installations persist an unpredictable pbx- identity independently of hostname and activation. Retained service identities take precedence. Existing my- identities and signing keys are not migrated by the neutral identity feature. Malformed or conflicting protected state is rejected.

Verified command example

fwconsole domaintains identity
fwconsole domaintains status

Protect the store

Signing and activation state live in protected Asterisk runtime storage. Directories use 0700 and sensitive files 0600. Atomic writes preserve those protections. Root console operations switch to the Asterisk account before module access; the storage helpers refuse effective-root access.

Understand lifecycle operations

Deactivate preserves signing identity, endpoint, routing policy, ownership and PBX configuration. Reactivate deliberately replaces retained authorisation after confirmation and uses the existing key. Operator token rotation is not permission to reset a provider public-key binding.