# Secrets — not stored in this repo

Live passwords/keys live in sibling **`koopa-admin-secrets`**.

## Map

### Taler — host `/root`

| What | Mirror (`koopa-admin-secrets/…`) | Live |
|------|----------------------------------|------|
| Bank admin/exchange/explorer/demo/bench | `koopa/host-root/taler-bank/*.txt` | `/root/bank-*-password.txt` |
| Merchant instance goa-demo | `koopa/host-root/taler-merchant/…` | `/root/merchant-*-password.txt` |
| Exchange ATTRIBUTE_ENCRYPTION_KEY | `containers/taler-exchange/secrets/exchange-attribute-encryption.secret.conf` | container `/etc/taler-exchange/secrets/` |
| Exchange wire / DB | `…/*.secret.conf` (+ `.example` templates) | same under container |

### Apps — `/home/hernani/`

| What | Mirror | Live |
|------|--------|------|
| Castopod | `koopa/home-hernani/koopa-castopod/{.env,users.env}` | `~/koopa-castopod/` |
| Bonfire (`FEDERATE=true`) | `koopa/home-hernani/koopa-bonfire/{.env,users.env,compose.yml}` | `~/koopa-bonfire/` |
| Prime (Jellyfin + qBittorrent) | `koopa/home-hernani/koopa-prime/{.env,users.env}` | `~/koopa-prime/` |
| Forgejo (**rootless**, git.hacktivism.ch) | `koopa/home-hernani/koopa-forgejo/{.env,users.env,compose.yml}` | `~/koopa-forgejo/` |

## Rules

- **koopa-admin-log**: paths only; `@inline-secret@` in configs, never password/key material.
- Pull/deploy: `koopa-admin-secrets/scripts/{pull,deploy}-from-koopa.sh`
- Full inventory: `koopa-admin-secrets/MAP.md`

## Public (OK here)

- `MASTER_PUBLIC_KEY` / merchant `MASTER_KEY` (exchange public master key)
- Port maps, unit ladders, non-secret overrides