silverlinux-infra/docs/secrets.md

Secrets Management

Overview

SilverLinux uses Infisical for centralized secret management. Secrets are injected into standard Compose stacks at runtime by slcompose, which wraps infisical run.

This repository no longer depends on a local /srv/secrets/company.env file for deployed services. If that file still exists on the server, remove it after confirming all required values are present in Infisical.

Sentry is the only documented exception to the standard pattern. It follows the upstream self-hosted Sentry installation model because it is a much larger multi-service application.

---

Purpose

The Infisical deployment flow provides a single source of truth for:

• SMTP credentials
• Database passwords
• Application secrets
• OAuth client secrets
• Future API keys

Applications should load secrets using Infisical injection at deployment time through slcompose.

Example:

slcompose up gitea

---

Current Variables

Email

SMTP_HOST
SMTP_PORT
SMTP_USERNAME
SMTP_PASSWORD

Used by:

• Gitea
• OpenProject
• Future services

---

PostgreSQL

POSTGRES_ROOT_PASSWORD
POSTGRES_OPENPROJECT_PASSWORD

Used by:

• PostgreSQL
• OpenProject
• Gitea

---

Microsoft SQL Server

MSSQL_SA_PASSWORD

Used by:

• Microsoft SQL Server 2022 Express
• DbGate's MSSQL connection

---

OpenProject

OPENPROJECT_SECRET_KEY_BASE

Used by:

• OpenProject

---

Gitea Actions Runner

GITEA_RUNNER_REGISTRATION_TOKEN

Used by:

• The global silverlinux-runner
• Runner registration and reconnection

Repository workflow credentials, including BAGET_API_KEY, are stored in Gitea under Repository Settings -> Actions -> Secrets and are not stored in repositories.

---

Jitsi

JICOFO_AUTH_PASSWORD
JVB_AUTH_PASSWORD
JIBRI_XMPP_PASSWORD
JIBRI_RECORDER_PASSWORD
JIGASI_XMPP_PASSWORD
JIGASI_TRANSCRIBER_PASSWORD

Used by:

• Jitsi Meet

---

Nextcloud

NEXTCLOUD_ADMIN_USER
NEXTCLOUD_ADMIN_PASSWORD
POSTGRES_DB
POSTGRES_USER
POSTGRES_PASSWORD
SMTP_HOST
SMTP_PORT
SMTP_USERNAME
SMTP_PASSWORD

Used by:

• Nextcloud
• Nextcloud PostgreSQL
• Nextcloud notification email

Infisical path:

/nextcloud

Notes:

• The 2026-07-08 runtime snapshot showed /srv/docker/nextcloud/.env present on the server.
• Do not commit the raw .env file or config.php.
• config.php includes high-sensitivity values such as secret, passwordsalt, database credentials and SMTP credentials.

---

Future OAuth

GOOGLE_CLIENT_ID
GOOGLE_CLIENT_SECRET

GITHUB_CLIENT_ID
GITHUB_CLIENT_SECRET

MICROSOFT_CLIENT_ID
MICROSOFT_CLIENT_SECRET

Future use:

• Gitea
• OpenProject
• Other applications

---

Sentry Exception

Sentry self-hosted installer secrets

Used by:

• Sentry

Notes:

• Sentry does not follow the same simple slcompose + Infisical pattern as the other SilverLinux services.
• Keep Sentry secrets out of this repository.
• Document any Sentry-specific backup or restore requirements in docs/sentry.md.

---

Rules

• Never commit secrets to Git.
• Never store passwords directly in docker-compose files.
• Never share Infisical exports, tokens or raw service .env files.
• Use environment variables whenever possible.
• Use .env.example files for documentation.
• Rotate credentials immediately if exposure is suspected.

---

Backup Requirements

Backups must preserve the ability to recover Infisical-managed secrets.

Infisical project data and service secret paths

Loss of the Infisical secret source may prevent applications from starting correctly.

---

Recovery Procedure

If the server must be rebuilt:

1. Restore or reauthorize Infisical access.
2. Verify /etc/infisical/token and any required Infisical domain configuration.
3. Deploy Docker stacks through slcompose.
4. Verify services can access required variables.
5. Verify SMTP functionality.
6. Verify database connectivity.

---

Security Notes

Infisical contains credentials for multiple services.

Access should be restricted to system administrators only.

The local Infisical token under /etc/infisical/token must be protected with root-only permissions.

---

Related Documents

• docs/email.md
• docs/security.md
• docs/server.md
• docs/backups.md