25 lines
1.5 KiB
Markdown
25 lines
1.5 KiB
Markdown
# Secrets — not stored in this repo
|
|
|
|
Live passwords/keys live in sibling **`koopa-admin-secrets`** and on host/containers.
|
|
|
|
## Map
|
|
|
|
| What | Where (mirror) | Where (live) |
|
|
|------|----------------|--------------|
|
|
| Bank admin / explorer / exchange user passwords | `koopa-admin-secrets/koopa/host-root/taler-bank/*.txt` | `/root/bank-*-password.txt` on koopa |
|
|
| Merchant instance password (goa-demo-…) | `…/taler-merchant/merchant-*-password.txt` | `/root/merchant-*-password.txt` |
|
|
| Exchange `ATTRIBUTE_ENCRYPTION_KEY` | `…/containers/taler-exchange/secrets/exchange-attribute-encryption.secret.conf` | `/etc/taler-exchange/secrets/…` in exchange container |
|
|
| Exchange wire gateway credentials | `…/containers/taler-exchange/secrets/exchange-accountcredentials-1.secret.conf` | same under container `/etc/taler-exchange/secrets/` |
|
|
| Exchange / merchant / bank DB secrets | container `…/secrets/*-db.secret.conf` (if exported) | container `/etc/…/secrets/` |
|
|
| Castopod / MariaDB passwords | host compose env (not mirrored here) | castopod stack env files |
|
|
|
|
## Rules
|
|
|
|
- **koopa-admin-log** may document *paths* and use `@inline-secret@` only.
|
|
- Never commit password files, raw tokens, or `ATTRIBUTE_ENCRYPTION_KEY` hex.
|
|
- Pull/deploy: `koopa-admin-secrets/scripts/{pull,deploy}-from-koopa.sh`.
|
|
|
|
## Public (OK in this repo)
|
|
|
|
- `MASTER_PUBLIC_KEY` / merchant `MASTER_KEY` (exchange master **public** key, also on `/keys`)
|
|
- Port maps, unit ladders, non-secret overrides
|