silverlinux-infra/docs/secrets.md

Secrets Management

Overview

SilverLinux uses a centralized secrets file for shared credentials and sensitive configuration.

Location:

/srv/secrets/company.env

This file is stored on the server and is never committed to Git.

---

Purpose

The secrets file provides a single location for:

• SMTP credentials
• Database passwords
• Application secrets
• OAuth client secrets
• Future API keys

Applications should load secrets using:

env_file:
  - /srv/secrets/company.env

---

Current Variables

Email

SMTP_HOST
SMTP_PORT
SMTP_USERNAME
SMTP_PASSWORD

Used by:

• Gitea
• OpenProject
• Future services

---

PostgreSQL

POSTGRES_ROOT_PASSWORD
POSTGRES_OPENPROJECT_PASSWORD

Used by:

• PostgreSQL
• OpenProject
• Gitea

---

OpenProject

OPENPROJECT_SECRET_KEY_BASE

Used by:

• OpenProject

---

Gitea Actions Runner

GITEA_RUNNER_REGISTRATION_TOKEN

Used by:

• The global silverlinux-runner
• Runner registration and reconnection

Repository workflow credentials, including BAGET_API_KEY, are stored in Gitea under Repository Settings -> Actions -> Secrets and are not stored in repositories.

---

Jitsi

JICOFO_AUTH_PASSWORD
JVB_AUTH_PASSWORD
JIBRI_XMPP_PASSWORD
JIBRI_RECORDER_PASSWORD
JIGASI_XMPP_PASSWORD
JIGASI_TRANSCRIBER_PASSWORD

Used by:

• Jitsi Meet

---

Future OAuth

GOOGLE_CLIENT_ID
GOOGLE_CLIENT_SECRET

GITHUB_CLIENT_ID
GITHUB_CLIENT_SECRET

MICROSOFT_CLIENT_ID
MICROSOFT_CLIENT_SECRET

Future use:

• Gitea
• OpenProject
• Other applications

---

Rules

• Never commit secrets to Git.
• Never store passwords directly in docker-compose files.
• Never share the contents of company.env.
• Use environment variables whenever possible.
• Use .env.example files for documentation.
• Rotate credentials immediately if exposure is suspected.

---

Backup Requirements

The following file must be included in server backups:

/srv/secrets/company.env

Loss of this file may prevent applications from starting correctly.

---

Recovery Procedure

If the server must be rebuilt:

1. Restore /srv/secrets/company.env
2. Verify file permissions
3. Deploy Docker stacks
4. Verify services can access required variables
5. Verify SMTP functionality
6. Verify database connectivity

---

Security Notes

The secrets file contains credentials for multiple services.

Access should be restricted to system administrators only.

Recommended permissions:

chmod 600 /srv/secrets/company.env

Recommended ownership:

root:root

---

Related Documents

• docs/email.md
• docs/security.md
• docs/server.md
• docs/backups.md