Oclick021
a9a758d332
- Add slcompose.sh: Central orchestrator for managing all Docker services * Boot all services at startup with automated Infisical secret injection * Commands: up, down, restart, logs, logs-tail, env, env-all * Colored environment variable output (blue names, green values) - Add slcompose.service: Systemd service file for auto-boot on startup * Type=oneshot with RemainAfterExit=yes * Waits for Docker service before starting * Runs on multi-user.target - Add orchestration.md: Comprehensive documentation * Architecture and installation guide * Usage examples for all commands * Secret injection flow and troubleshooting * Performance and security notes - Update README.md and AI_CONTEXT.md * Document service orchestration architecture * Explain slcompose functionality and commands * Reference new orchestration documentation
3.3 KiB
Secrets Management
Overview
SilverLinux uses Infisical for centralized secret management. Secrets are injected into Compose stacks at runtime by infisical run.
This repository no longer depends on a local /srv/secrets/company.env file for deployed services.
Purpose
The Infisical deployment flow provides a single source of truth for:
- SMTP credentials
- Database passwords
- Application secrets
- OAuth client secrets
- Future API keys
Applications should load secrets using Infisical injection at deployment time.
Example:
infisical run --path=/ --recursive -- docker compose up -d
Current Variables
SMTP_HOST
SMTP_PORT
SMTP_USERNAME
SMTP_PASSWORD
Used by:
- Gitea
- OpenProject
- Future services
PostgreSQL
POSTGRES_ROOT_PASSWORD
POSTGRES_OPENPROJECT_PASSWORD
Used by:
- PostgreSQL
- OpenProject
- Gitea
Microsoft SQL Server
MSSQL_SA_PASSWORD
Used by:
- Microsoft SQL Server 2022 Express
- DbGate's MSSQL connection
OpenProject
OPENPROJECT_SECRET_KEY_BASE
Used by:
- OpenProject
Gitea Actions Runner
GITEA_RUNNER_REGISTRATION_TOKEN
Used by:
- The global
silverlinux-runner - Runner registration and reconnection
Repository workflow credentials, including BAGET_API_KEY, are stored in Gitea under Repository Settings -> Actions -> Secrets and are not stored in repositories.
Jitsi
JICOFO_AUTH_PASSWORD
JVB_AUTH_PASSWORD
JIBRI_XMPP_PASSWORD
JIBRI_RECORDER_PASSWORD
JIGASI_XMPP_PASSWORD
JIGASI_TRANSCRIBER_PASSWORD
Used by:
- Jitsi Meet
Future OAuth
GOOGLE_CLIENT_ID
GOOGLE_CLIENT_SECRET
GITHUB_CLIENT_ID
GITHUB_CLIENT_SECRET
MICROSOFT_CLIENT_ID
MICROSOFT_CLIENT_SECRET
Future use:
- Gitea
- OpenProject
- Other applications
DbGate Credential Migration
The running DbGate deployment currently has its login credential in the server-side Compose configuration. Move the password to:
/srv/secrets/company.env
DBGATE_PASSWORD
The repository Compose definition already references DBGATE_PASSWORD and contains no real password.
Status:
Migration pending
Rules
- Never commit secrets to Git.
- Never store passwords directly in docker-compose files.
- Never share the contents of company.env.
- Use environment variables whenever possible.
- Use
.env.examplefiles for documentation. - Rotate credentials immediately if exposure is suspected.
Backup Requirements
The following file must be included in server backups:
/srv/secrets/company.env
Loss of this file may prevent applications from starting correctly.
Recovery Procedure
If the server must be rebuilt:
- Restore
/srv/secrets/company.env - Verify file permissions
- Deploy Docker stacks
- Verify services can access required variables
- Verify SMTP functionality
- Verify database connectivity
Security Notes
The secrets file contains credentials for multiple services.
Access should be restricted to system administrators only.
Recommended permissions:
chmod 600 /srv/secrets/company.env
Recommended ownership:
root:root
Related Documents
- docs/email.md
- docs/security.md
- docs/server.md
- docs/backups.md