197 lines
2.7 KiB
Markdown
197 lines
2.7 KiB
Markdown
# Secrets Management
|
|
|
|
## Overview
|
|
|
|
SilverLinux uses a centralized secrets file for shared credentials and sensitive configuration.
|
|
|
|
Location:
|
|
|
|
```text
|
|
/srv/secrets/company.env
|
|
```
|
|
|
|
This file is stored on the server and is never committed to Git.
|
|
|
|
---
|
|
|
|
## Purpose
|
|
|
|
The secrets file provides a single location for:
|
|
|
|
* SMTP credentials
|
|
* Database passwords
|
|
* Application secrets
|
|
* OAuth client secrets
|
|
* Future API keys
|
|
|
|
Applications should load secrets using:
|
|
|
|
```yaml
|
|
env_file:
|
|
- /srv/secrets/company.env
|
|
```
|
|
|
|
---
|
|
|
|
## Current Variables
|
|
|
|
### Email
|
|
|
|
```text
|
|
SMTP_HOST
|
|
SMTP_PORT
|
|
SMTP_USERNAME
|
|
SMTP_PASSWORD
|
|
```
|
|
|
|
Used by:
|
|
|
|
* Gitea
|
|
* OpenProject
|
|
* Future services
|
|
|
|
---
|
|
|
|
### PostgreSQL
|
|
|
|
```text
|
|
POSTGRES_ROOT_PASSWORD
|
|
POSTGRES_OPENPROJECT_PASSWORD
|
|
```
|
|
|
|
Used by:
|
|
|
|
* PostgreSQL
|
|
* OpenProject
|
|
* Gitea
|
|
|
|
---
|
|
|
|
### OpenProject
|
|
|
|
```text
|
|
OPENPROJECT_SECRET_KEY_BASE
|
|
```
|
|
|
|
Used by:
|
|
|
|
* OpenProject
|
|
|
|
---
|
|
|
|
### Gitea Actions Runner
|
|
|
|
```text
|
|
GITEA_RUNNER_REGISTRATION_TOKEN
|
|
```
|
|
|
|
Used by:
|
|
|
|
* The global `silverlinux-runner`
|
|
* Runner registration and reconnection
|
|
|
|
Repository workflow credentials, including `BAGET_API_KEY`, are stored in Gitea under **Repository Settings -> Actions -> Secrets** and are not stored in repositories.
|
|
|
|
---
|
|
|
|
### Jitsi
|
|
|
|
```text
|
|
JICOFO_AUTH_PASSWORD
|
|
JVB_AUTH_PASSWORD
|
|
JIBRI_XMPP_PASSWORD
|
|
JIBRI_RECORDER_PASSWORD
|
|
JIGASI_XMPP_PASSWORD
|
|
JIGASI_TRANSCRIBER_PASSWORD
|
|
```
|
|
|
|
Used by:
|
|
|
|
* Jitsi Meet
|
|
|
|
---
|
|
|
|
### Future OAuth
|
|
|
|
```text
|
|
GOOGLE_CLIENT_ID
|
|
GOOGLE_CLIENT_SECRET
|
|
|
|
GITHUB_CLIENT_ID
|
|
GITHUB_CLIENT_SECRET
|
|
|
|
MICROSOFT_CLIENT_ID
|
|
MICROSOFT_CLIENT_SECRET
|
|
```
|
|
|
|
Future use:
|
|
|
|
* Gitea
|
|
* OpenProject
|
|
* Other applications
|
|
|
|
---
|
|
|
|
## Rules
|
|
|
|
* Never commit secrets to Git.
|
|
* Never store passwords directly in docker-compose files.
|
|
* Never share the contents of company.env.
|
|
* Use environment variables whenever possible.
|
|
* Use `.env.example` files for documentation.
|
|
* Rotate credentials immediately if exposure is suspected.
|
|
|
|
---
|
|
|
|
## Backup Requirements
|
|
|
|
The following file must be included in server backups:
|
|
|
|
```text
|
|
/srv/secrets/company.env
|
|
```
|
|
|
|
Loss of this file may prevent applications from starting correctly.
|
|
|
|
---
|
|
|
|
## Recovery Procedure
|
|
|
|
If the server must be rebuilt:
|
|
|
|
1. Restore `/srv/secrets/company.env`
|
|
2. Verify file permissions
|
|
3. Deploy Docker stacks
|
|
4. Verify services can access required variables
|
|
5. Verify SMTP functionality
|
|
6. Verify database connectivity
|
|
|
|
---
|
|
|
|
## Security Notes
|
|
|
|
The secrets file contains credentials for multiple services.
|
|
|
|
Access should be restricted to system administrators only.
|
|
|
|
Recommended permissions:
|
|
|
|
```bash
|
|
chmod 600 /srv/secrets/company.env
|
|
```
|
|
|
|
Recommended ownership:
|
|
|
|
```bash
|
|
root:root
|
|
```
|
|
|
|
---
|
|
|
|
## Related Documents
|
|
|
|
* docs/email.md
|
|
* docs/security.md
|
|
* docs/server.md
|
|
* docs/backups.md
|