34 lines
1.6 KiB
Markdown
34 lines
1.6 KiB
Markdown
# Secrets — not stored in this repo
|
|
|
|
Live passwords/keys live in sibling **`koopa-admin-secrets`**.
|
|
|
|
## Map
|
|
|
|
### Taler — host `/root`
|
|
|
|
| What | Mirror (`koopa-admin-secrets/…`) | Live |
|
|
|------|----------------------------------|------|
|
|
| Bank admin/exchange/explorer/demo/bench | `koopa/host-root/taler-bank/*.txt` | `/root/bank-*-password.txt` |
|
|
| Merchant instance goa-demo | `koopa/host-root/taler-merchant/…` | `/root/merchant-*-password.txt` |
|
|
| Exchange ATTRIBUTE_ENCRYPTION_KEY | `containers/taler-exchange/secrets/exchange-attribute-encryption.secret.conf` | container `/etc/taler-exchange/secrets/` |
|
|
| Exchange wire / DB | `…/*.secret.conf` (+ `.example` templates) | same under container |
|
|
|
|
### Apps — `/home/hernani/`
|
|
|
|
| What | Mirror | Live |
|
|
|------|--------|------|
|
|
| Castopod | `koopa/home-hernani/koopa-castopod/{.env,users.env}` | `~/koopa-castopod/` |
|
|
| Bonfire (`FEDERATE=true`) | `koopa/home-hernani/koopa-bonfire/{.env,users.env,compose.yml}` | `~/koopa-bonfire/` |
|
|
| Prime (Jellyfin + qBittorrent) | `koopa/home-hernani/koopa-prime/{.env,users.env}` | `~/koopa-prime/` |
|
|
| Forgejo (**rootless**, git.hacktivism.ch) | `koopa/home-hernani/koopa-forgejo/{.env,users.env,compose.yml}` | `~/koopa-forgejo/` |
|
|
|
|
## Rules
|
|
|
|
- **koopa-admin-log**: paths only; `@inline-secret@` in configs, never password/key material.
|
|
- Pull/deploy: `koopa-admin-secrets/scripts/{pull,deploy}-from-koopa.sh`
|
|
- Full inventory: `koopa-admin-secrets/MAP.md`
|
|
|
|
## Public (OK here)
|
|
|
|
- `MASTER_PUBLIC_KEY` / merchant `MASTER_KEY` (exchange public master key)
|
|
- Port maps, unit ladders, non-secret overrides
|