# Secrets Management

## Overview

SilverLinux uses a centralized secrets file for shared credentials and sensitive configuration.

Location:

```text
/srv/secrets/company.env
```

This file is stored on the server and is never committed to Git.

---

## Purpose

The secrets file provides a single location for:

* SMTP credentials
* Database passwords
* Application secrets
* OAuth client secrets
* Future API keys

Applications should load secrets using:

```yaml
env_file:
  - /srv/secrets/company.env
```

---

## Current Variables

### Email

```text
SMTP_HOST
SMTP_PORT
SMTP_USERNAME
SMTP_PASSWORD
```

Used by:

* Gitea
* OpenProject
* Future services

---

### PostgreSQL

```text
POSTGRES_ROOT_PASSWORD
POSTGRES_OPENPROJECT_PASSWORD
```

Used by:

* PostgreSQL
* OpenProject
* Gitea

---

### Microsoft SQL Server

```text
MSSQL_SA_PASSWORD
```

Used by:

* Microsoft SQL Server 2022 Express
* DbGate's MSSQL connection

---

### OpenProject

```text
OPENPROJECT_SECRET_KEY_BASE
```

Used by:

* OpenProject

---

### Gitea Actions Runner

```text
GITEA_RUNNER_REGISTRATION_TOKEN
```

Used by:

* The global `silverlinux-runner`
* Runner registration and reconnection

Repository workflow credentials, including `BAGET_API_KEY`, are stored in Gitea under **Repository Settings -> Actions -> Secrets** and are not stored in repositories.

---

### Jitsi

```text
JICOFO_AUTH_PASSWORD
JVB_AUTH_PASSWORD
JIBRI_XMPP_PASSWORD
JIBRI_RECORDER_PASSWORD
JIGASI_XMPP_PASSWORD
JIGASI_TRANSCRIBER_PASSWORD
```

Used by:

* Jitsi Meet

---

### Future OAuth

```text
GOOGLE_CLIENT_ID
GOOGLE_CLIENT_SECRET

GITHUB_CLIENT_ID
GITHUB_CLIENT_SECRET

MICROSOFT_CLIENT_ID
MICROSOFT_CLIENT_SECRET
```

Future use:

* Gitea
* OpenProject
* Other applications

---

### DbGate Credential Migration

The running DbGate deployment currently has its login credential in the server-side Compose configuration. Move the password to:

```text
/srv/secrets/company.env
DBGATE_PASSWORD
```

The repository Compose definition already references `DBGATE_PASSWORD` and contains no real password.

Status:

```text
Migration pending
```

---

## Rules

* Never commit secrets to Git.
* Never store passwords directly in docker-compose files.
* Never share the contents of company.env.
* Use environment variables whenever possible.
* Use `.env.example` files for documentation.
* Rotate credentials immediately if exposure is suspected.

---

## Backup Requirements

The following file must be included in server backups:

```text
/srv/secrets/company.env
```

Loss of this file may prevent applications from starting correctly.

---

## Recovery Procedure

If the server must be rebuilt:

1. Restore `/srv/secrets/company.env`
2. Verify file permissions
3. Deploy Docker stacks
4. Verify services can access required variables
5. Verify SMTP functionality
6. Verify database connectivity

---

## Security Notes

The secrets file contains credentials for multiple services.

Access should be restricted to system administrators only.

Recommended permissions:

```bash
chmod 600 /srv/secrets/company.env
```

Recommended ownership:

```bash
root:root
```

---

## Related Documents

* docs/email.md
* docs/security.md
* docs/server.md
* docs/backups.md