koopa-admin-log/SECRETS.md

Secrets — not stored in this repo

Live passwords/keys live in sibling koopa-admin-secrets.

Map

Taler — host /root

What	Mirror (koopa-admin-secrets/…)	Live
Bank admin/exchange/explorer/demo/bench	koopa/host-root/taler-bank/*.txt	/root/bank-*-password.txt
Merchant instance goa-demo	koopa/host-root/taler-merchant/…	/root/merchant-*-password.txt
Exchange ATTRIBUTE_ENCRYPTION_KEY	containers/taler-exchange/secrets/exchange-attribute-encryption.secret.conf	container /etc/taler-exchange/secrets/
Exchange wire / DB	…/*.secret.conf (+ .example templates)	same under container

Apps — /home/hernani/

What	Mirror	Live
Castopod	koopa/home-hernani/koopa-castopod/{.env,users.env}	~/koopa-castopod/
Bonfire (FEDERATE=true)	koopa/home-hernani/koopa-bonfire/{.env,users.env,compose.yml}	~/koopa-bonfire/
Prime (Jellyfin + qBittorrent)	koopa/home-hernani/koopa-prime/{.env,users.env}	~/koopa-prime/
Forgejo (rootless, git.hacktivism.ch)	koopa/home-hernani/koopa-forgejo/{.env,users.env,compose.yml}	~/koopa-forgejo/

Rules

• koopa-admin-log: paths only; @inline-secret@ in configs, never password/key material.
• Pull/deploy: koopa-admin-secrets/scripts/{pull,deploy}-from-koopa.sh
• Full inventory: koopa-admin-secrets/MAP.md

Public (OK here)

• MASTER_PUBLIC_KEY / merchant MASTER_KEY (exchange public master key)
• Port maps, unit ladders, non-secret overrides