koopa-admin-log/SECRETS.md

Secrets — not stored in this repo

Live passwords/keys live in sibling koopa-admin-secrets and on host/containers.

Map

What	Where (mirror)	Where (live)
Bank admin / explorer / exchange user passwords	koopa-admin-secrets/koopa/host-root/taler-bank/*.txt	/root/bank-*-password.txt on koopa
Merchant instance password (goa-demo-…)	…/taler-merchant/merchant-*-password.txt	/root/merchant-*-password.txt
Exchange ATTRIBUTE_ENCRYPTION_KEY	…/containers/taler-exchange/secrets/exchange-attribute-encryption.secret.conf	/etc/taler-exchange/secrets/… in exchange container
Exchange wire gateway credentials	…/containers/taler-exchange/secrets/exchange-accountcredentials-1.secret.conf	same under container /etc/taler-exchange/secrets/
Exchange / merchant / bank DB secrets	container …/secrets/*-db.secret.conf (if exported)	container /etc/…/secrets/
Castopod / MariaDB passwords	host compose env (not mirrored here)	castopod stack env files

Rules

• koopa-admin-log may document paths and use @inline-secret@ only.
• Never commit password files, raw tokens, or ATTRIBUTE_ENCRYPTION_KEY hex.
• Pull/deploy: koopa-admin-secrets/scripts/{pull,deploy}-from-koopa.sh.

Public (OK in this repo)

• MASTER_PUBLIC_KEY / merchant MASTER_KEY (exchange master public key, also on /keys)
• Port maps, unit ladders, non-secret overrides