From e446510b613b9e2d0d977998e54387affdea4572 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Hern=C3=A2ni=20Marques?= Date: Fri, 10 Jul 2026 11:40:33 +0200 Subject: [PATCH] =?UTF-8?q?docs:=20SECRETS.md=20=E2=80=94=20paths=20only;?= =?UTF-8?q?=20no=20secret=20values=20in=20this=20repo?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- SECRETS.md | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) create mode 100644 SECRETS.md diff --git a/SECRETS.md b/SECRETS.md new file mode 100644 index 0000000..8995a88 --- /dev/null +++ b/SECRETS.md @@ -0,0 +1,25 @@ +# Secrets — not stored in this repo + +Live passwords/keys live in sibling **`koopa-admin-secrets`** and on host/containers. + +## Map + +| What | Where (mirror) | Where (live) | +|------|----------------|--------------| +| Bank admin / explorer / exchange user passwords | `koopa-admin-secrets/koopa/host-root/taler-bank/*.txt` | `/root/bank-*-password.txt` on koopa | +| Merchant instance password (goa-demo-…) | `…/taler-merchant/merchant-*-password.txt` | `/root/merchant-*-password.txt` | +| Exchange `ATTRIBUTE_ENCRYPTION_KEY` | `…/containers/taler-exchange/secrets/exchange-attribute-encryption.secret.conf` | `/etc/taler-exchange/secrets/…` in exchange container | +| Exchange wire gateway credentials | `…/containers/taler-exchange/secrets/exchange-accountcredentials-1.secret.conf` | same under container `/etc/taler-exchange/secrets/` | +| Exchange / merchant / bank DB secrets | container `…/secrets/*-db.secret.conf` (if exported) | container `/etc/…/secrets/` | +| Castopod / MariaDB passwords | host compose env (not mirrored here) | castopod stack env files | + +## Rules + +- **koopa-admin-log** may document *paths* and use `@inline-secret@` only. +- Never commit password files, raw tokens, or `ATTRIBUTE_ENCRYPTION_KEY` hex. +- Pull/deploy: `koopa-admin-secrets/scripts/{pull,deploy}-from-koopa.sh`. + +## Public (OK in this repo) + +- `MASTER_PUBLIC_KEY` / merchant `MASTER_KEY` (exchange master **public** key, also on `/keys`) +- Port maps, unit ladders, non-secret overrides