# Secrets Management ## Overview SilverLinux uses Infisical for centralized secret management. Secrets are injected into standard Compose stacks at runtime by `slcompose`, which wraps `infisical run`. This repository no longer depends on a local `/srv/secrets/company.env` file for deployed services. If that file still exists on the server, remove it after confirming all required values are present in Infisical. Sentry is the only documented exception to the standard pattern. It follows the upstream self-hosted Sentry installation model because it is a much larger multi-service application. --- ## Purpose The Infisical deployment flow provides a single source of truth for: * SMTP credentials * Database passwords * Application secrets * OAuth client secrets * Future API keys Applications should load secrets using Infisical injection at deployment time through `slcompose`. Example: ```bash slcompose up gitea ``` --- ## Current Variables ### Email ```text SMTP_HOST SMTP_PORT SMTP_USERNAME SMTP_PASSWORD ``` Used by: * Gitea * OpenProject * Future services --- ### PostgreSQL ```text POSTGRES_ROOT_PASSWORD POSTGRES_OPENPROJECT_PASSWORD ``` Used by: * PostgreSQL * OpenProject * Gitea --- ### Microsoft SQL Server ```text MSSQL_SA_PASSWORD ``` Used by: * Microsoft SQL Server 2022 Express * DbGate's MSSQL connection --- ### OpenProject ```text OPENPROJECT_SECRET_KEY_BASE ``` Used by: * OpenProject --- ### Gitea Actions Runner ```text GITEA_RUNNER_REGISTRATION_TOKEN ``` Used by: * The global `silverlinux-runner` * Runner registration and reconnection Repository workflow credentials, including `BAGET_API_KEY`, are stored in Gitea under **Repository Settings -> Actions -> Secrets** and are not stored in repositories. --- ### Jitsi ```text JICOFO_AUTH_PASSWORD JVB_AUTH_PASSWORD JIBRI_XMPP_PASSWORD JIBRI_RECORDER_PASSWORD JIGASI_XMPP_PASSWORD JIGASI_TRANSCRIBER_PASSWORD ``` Used by: * Jitsi Meet --- ### Nextcloud ```text NEXTCLOUD_ADMIN_USER NEXTCLOUD_ADMIN_PASSWORD POSTGRES_DB POSTGRES_USER POSTGRES_PASSWORD SMTP_HOST SMTP_PORT SMTP_USERNAME SMTP_PASSWORD ``` Used by: * Nextcloud * Nextcloud PostgreSQL * Nextcloud notification email Infisical path: ```text /nextcloud ``` Notes: * The 2026-07-08 runtime snapshot showed `/srv/docker/nextcloud/.env` present on the server. * Do not commit the raw `.env` file or `config.php`. * `config.php` includes high-sensitivity values such as `secret`, `passwordsalt`, database credentials and SMTP credentials. --- ### Future OAuth ```text GOOGLE_CLIENT_ID GOOGLE_CLIENT_SECRET GITHUB_CLIENT_ID GITHUB_CLIENT_SECRET MICROSOFT_CLIENT_ID MICROSOFT_CLIENT_SECRET ``` Future use: * Gitea * OpenProject * Other applications --- ### Sentry Exception ```text Sentry self-hosted installer secrets ``` Used by: * Sentry Notes: * Sentry does not follow the same simple `slcompose` + Infisical pattern as the other SilverLinux services. * Keep Sentry secrets out of this repository. * Document any Sentry-specific backup or restore requirements in [docs/sentry.md](sentry.md). --- ## Rules * Never commit secrets to Git. * Never store passwords directly in docker-compose files. * Never share Infisical exports, tokens or raw service `.env` files. * Use environment variables whenever possible. * Use `.env.example` files for documentation. * Rotate credentials immediately if exposure is suspected. --- ## Backup Requirements Backups must preserve the ability to recover Infisical-managed secrets. ```text Infisical project data and service secret paths ``` Loss of the Infisical secret source may prevent applications from starting correctly. --- ## Recovery Procedure If the server must be rebuilt: 1. Restore or reauthorize Infisical access. 2. Verify `/etc/infisical/token` and any required Infisical domain configuration. 3. Deploy Docker stacks through `slcompose`. 4. Verify services can access required variables. 5. Verify SMTP functionality. 6. Verify database connectivity. --- ## Security Notes Infisical contains credentials for multiple services. Access should be restricted to system administrators only. The local Infisical token under `/etc/infisical/token` must be protected with root-only permissions. --- ## Related Documents * docs/email.md * docs/security.md * docs/server.md * docs/backups.md