updating the documentation of the SilverLinux Insftracture

docs/secrets.md

@@ -0,0 +1,181 @@
+# Secrets Management
+
+## Overview
+
+SilverLinux uses a centralized secrets file for shared credentials and sensitive configuration.
+
+Location:
+
+```text
+/srv/secrets/company.env
+```
+
+This file is stored on the server and is never committed to Git.
+
+---
+
+## Purpose
+
+The secrets file provides a single location for:
+
+* SMTP credentials
+* Database passwords
+* Application secrets
+* OAuth client secrets
+* Future API keys
+
+Applications should load secrets using:
+
+```yaml
+env_file:
+  - /srv/secrets/company.env
+```
+
+---
+
+## Current Variables
+
+### Email
+
+```text
+SMTP_HOST
+SMTP_PORT
+SMTP_USERNAME
+SMTP_PASSWORD
+```
+
+Used by:
+
+* Gitea
+* OpenProject
+* Future services
+
+---
+
+### PostgreSQL
+
+```text
+POSTGRES_ROOT_PASSWORD
+POSTGRES_OPENPROJECT_PASSWORD
+```
+
+Used by:
+
+* PostgreSQL
+* OpenProject
+* Gitea
+
+---
+
+### OpenProject
+
+```text
+OPENPROJECT_SECRET_KEY_BASE
+```
+
+Used by:
+
+* OpenProject
+
+---
+
+### Jitsi
+
+```text
+JICOFO_AUTH_PASSWORD
+JVB_AUTH_PASSWORD
+JIBRI_XMPP_PASSWORD
+JIBRI_RECORDER_PASSWORD
+JIGASI_XMPP_PASSWORD
+JIGASI_TRANSCRIBER_PASSWORD
+```
+
+Used by:
+
+* Jitsi Meet
+
+---
+
+### Future OAuth
+
+```text
+GOOGLE_CLIENT_ID
+GOOGLE_CLIENT_SECRET
+
+GITHUB_CLIENT_ID
+GITHUB_CLIENT_SECRET
+
+MICROSOFT_CLIENT_ID
+MICROSOFT_CLIENT_SECRET
+```
+
+Future use:
+
+* Gitea
+* OpenProject
+* Other applications
+
+---
+
+## Rules
+
+* Never commit secrets to Git.
+* Never store passwords directly in docker-compose files.
+* Never share the contents of company.env.
+* Use environment variables whenever possible.
+* Use `.env.example` files for documentation.
+* Rotate credentials immediately if exposure is suspected.
+
+---
+
+## Backup Requirements
+
+The following file must be included in server backups:
+
+```text
+/srv/secrets/company.env
+```
+
+Loss of this file may prevent applications from starting correctly.
+
+---
+
+## Recovery Procedure
+
+If the server must be rebuilt:
+
+1. Restore `/srv/secrets/company.env`
+2. Verify file permissions
+3. Deploy Docker stacks
+4. Verify services can access required variables
+5. Verify SMTP functionality
+6. Verify database connectivity
+
+---
+
+## Security Notes
+
+The secrets file contains credentials for multiple services.
+
+Access should be restricted to system administrators only.
+
+Recommended permissions:
+
+```bash
+chmod 600 /srv/secrets/company.env
+```
+
+Recommended ownership:
+
+```bash
+root:root
+```
+
+---
+
+## Related Documents
+
+* docs/email.md
+* docs/security.md
+* docs/server.md
+* docs/backups.md