# Secrets — not stored in this repo

Live passwords/keys live in sibling **`koopa-admin-secrets`** and on host/containers.

## Map

| What | Where (mirror) | Where (live) |
|------|----------------|--------------|
| Bank admin / explorer / exchange user passwords | `koopa-admin-secrets/koopa/host-root/taler-bank/*.txt` | `/root/bank-*-password.txt` on koopa |
| Merchant instance password (goa-demo-…) | `…/taler-merchant/merchant-*-password.txt` | `/root/merchant-*-password.txt` |
| Exchange `ATTRIBUTE_ENCRYPTION_KEY` | `…/containers/taler-exchange/secrets/exchange-attribute-encryption.secret.conf` | `/etc/taler-exchange/secrets/…` in exchange container |
| Exchange wire gateway credentials | `…/containers/taler-exchange/secrets/exchange-accountcredentials-1.secret.conf` | same under container `/etc/taler-exchange/secrets/` |
| Exchange / merchant / bank DB secrets | container `…/secrets/*-db.secret.conf` (if exported) | container `/etc/…/secrets/` |
| Castopod / MariaDB passwords | host compose env (not mirrored here) | castopod stack env files |

## Rules

- **koopa-admin-log** may document *paths* and use `@inline-secret@` only.
- Never commit password files, raw tokens, or `ATTRIBUTE_ENCRYPTION_KEY` hex.
- Pull/deploy: `koopa-admin-secrets/scripts/{pull,deploy}-from-koopa.sh`.

## Public (OK in this repo)

- `MASTER_PUBLIC_KEY` / merchant `MASTER_KEY` (exchange master **public** key, also on `/keys`)
- Port maps, unit ladders, non-secret overrides