hernani/koopa-admin-log
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

docs: SECRETS.md map castopod/bonfire/prime home-hernani paths

Browse source
This commit is contained in:
Hernâni Marques 2026-07-10 13:12:38 +02:00
parent ac61ede972
commit 19c9fed12a
No known key found for this signature in database
1 changed files with 22 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

36
SECRETS.md
View file

@ -1,25 +1,33 @@
# Secrets — not stored in this repo # Secrets — not stored in this repo
Live passwords/keys live in sibling **`koopa-admin-secrets`** and on host/containers. Live passwords/keys live in sibling **`koopa-admin-secrets`**.
## Map ## Map
| What | Where (mirror) | Where (live) | ### Taler — host `/root`
|------|----------------|--------------|
| Bank admin / explorer / exchange user passwords | `koopa-admin-secrets/koopa/host-root/taler-bank/*.txt` | `/root/bank-*-password.txt` on koopa | | What | Mirror (`koopa-admin-secrets/…`) | Live |
| Merchant instance password (goa-demo-…) | `…/taler-merchant/merchant-*-password.txt` | `/root/merchant-*-password.txt` | |------|----------------------------------|------|
| Exchange `ATTRIBUTE_ENCRYPTION_KEY` | `…/containers/taler-exchange/secrets/exchange-attribute-encryption.secret.conf` | `/etc/taler-exchange/secrets/…` in exchange container | | Bank admin/exchange/explorer/demo/bench | `koopa/host-root/taler-bank/*.txt` | `/root/bank-*-password.txt` |
| Exchange wire gateway credentials | `…/containers/taler-exchange/secrets/exchange-accountcredentials-1.secret.conf` | same under container `/etc/taler-exchange/secrets/` | | Merchant instance goa-demo | `koopa/host-root/taler-merchant/…` | `/root/merchant-*-password.txt` |
| Exchange / merchant / bank DB secrets | container `…/secrets/*-db.secret.conf` (if exported) | container `/etc/…/secrets/` | | Exchange ATTRIBUTE_ENCRYPTION_KEY | `containers/taler-exchange/secrets/exchange-attribute-encryption.secret.conf` | container `/etc/taler-exchange/secrets/` |
| Castopod / MariaDB passwords | host compose env (not mirrored here) | castopod stack env files | | Exchange wire / DB | `…/*.secret.conf` (+ `.example` templates) | same under container |
### Apps — `/home/hernani/`
| What | Mirror | Live |
|------|--------|------|
| Castopod | `koopa/home-hernani/koopa-castopod/{.env,users.env}` | `~/koopa-castopod/` |
| Bonfire | `koopa/home-hernani/koopa-bonfire/{.env,users.env}` | `~/koopa-bonfire/` |
| Prime (Jellyfin + qBittorrent) | `koopa/home-hernani/koopa-prime/{.env,users.env}` | `~/koopa-prime/` |
## Rules ## Rules
- **koopa-admin-log** may document *paths* and use `@inline-secret@` only. - **koopa-admin-log**: paths only; `@inline-secret@` in configs, never password/key material.
- Never commit password files, raw tokens, or `ATTRIBUTE_ENCRYPTION_KEY` hex. - Pull/deploy: `koopa-admin-secrets/scripts/{pull,deploy}-from-koopa.sh`
- Pull/deploy: `koopa-admin-secrets/scripts/{pull,deploy}-from-koopa.sh`. - Full inventory: `koopa-admin-secrets/MAP.md`
## Public (OK in this repo) ## Public (OK here)
- `MASTER_PUBLIC_KEY` / merchant `MASTER_KEY` (exchange master **public** key, also on `/keys`) - `MASTER_PUBLIC_KEY` / merchant `MASTER_KEY` (exchange public master key)
- Port maps, unit ladders, non-secret overrides - Port maps, unit ladders, non-secret overrides