Oclick021
a9a758d332
- Add slcompose.sh: Central orchestrator for managing all Docker services * Boot all services at startup with automated Infisical secret injection * Commands: up, down, restart, logs, logs-tail, env, env-all * Colored environment variable output (blue names, green values) - Add slcompose.service: Systemd service file for auto-boot on startup * Type=oneshot with RemainAfterExit=yes * Waits for Docker service before starting * Runs on multi-user.target - Add orchestration.md: Comprehensive documentation * Architecture and installation guide * Usage examples for all commands * Secret injection flow and troubleshooting * Performance and security notes - Update README.md and AI_CONTEXT.md * Document service orchestration architecture * Explain slcompose functionality and commands * Reference new orchestration documentation
224 lines
3.3 KiB
Markdown
224 lines
3.3 KiB
Markdown
# Secrets Management
|
|
|
|
## Overview
|
|
|
|
SilverLinux uses Infisical for centralized secret management. Secrets are injected into Compose stacks at runtime by `infisical run`.
|
|
|
|
This repository no longer depends on a local `/srv/secrets/company.env` file for deployed services.
|
|
|
|
---
|
|
|
|
## Purpose
|
|
|
|
The Infisical deployment flow provides a single source of truth for:
|
|
|
|
* SMTP credentials
|
|
* Database passwords
|
|
* Application secrets
|
|
* OAuth client secrets
|
|
* Future API keys
|
|
|
|
Applications should load secrets using Infisical injection at deployment time.
|
|
|
|
Example:
|
|
|
|
```bash
|
|
infisical run --path=/ --recursive -- docker compose up -d
|
|
```
|
|
|
|
---
|
|
|
|
## Current Variables
|
|
|
|
### Email
|
|
|
|
```text
|
|
SMTP_HOST
|
|
SMTP_PORT
|
|
SMTP_USERNAME
|
|
SMTP_PASSWORD
|
|
```
|
|
|
|
Used by:
|
|
|
|
* Gitea
|
|
* OpenProject
|
|
* Future services
|
|
|
|
---
|
|
|
|
### PostgreSQL
|
|
|
|
```text
|
|
POSTGRES_ROOT_PASSWORD
|
|
POSTGRES_OPENPROJECT_PASSWORD
|
|
```
|
|
|
|
Used by:
|
|
|
|
* PostgreSQL
|
|
* OpenProject
|
|
* Gitea
|
|
|
|
---
|
|
|
|
### Microsoft SQL Server
|
|
|
|
```text
|
|
MSSQL_SA_PASSWORD
|
|
```
|
|
|
|
Used by:
|
|
|
|
* Microsoft SQL Server 2022 Express
|
|
* DbGate's MSSQL connection
|
|
|
|
---
|
|
|
|
### OpenProject
|
|
|
|
```text
|
|
OPENPROJECT_SECRET_KEY_BASE
|
|
```
|
|
|
|
Used by:
|
|
|
|
* OpenProject
|
|
|
|
---
|
|
|
|
### Gitea Actions Runner
|
|
|
|
```text
|
|
GITEA_RUNNER_REGISTRATION_TOKEN
|
|
```
|
|
|
|
Used by:
|
|
|
|
* The global `silverlinux-runner`
|
|
* Runner registration and reconnection
|
|
|
|
Repository workflow credentials, including `BAGET_API_KEY`, are stored in Gitea under **Repository Settings -> Actions -> Secrets** and are not stored in repositories.
|
|
|
|
---
|
|
|
|
### Jitsi
|
|
|
|
```text
|
|
JICOFO_AUTH_PASSWORD
|
|
JVB_AUTH_PASSWORD
|
|
JIBRI_XMPP_PASSWORD
|
|
JIBRI_RECORDER_PASSWORD
|
|
JIGASI_XMPP_PASSWORD
|
|
JIGASI_TRANSCRIBER_PASSWORD
|
|
```
|
|
|
|
Used by:
|
|
|
|
* Jitsi Meet
|
|
|
|
---
|
|
|
|
### Future OAuth
|
|
|
|
```text
|
|
GOOGLE_CLIENT_ID
|
|
GOOGLE_CLIENT_SECRET
|
|
|
|
GITHUB_CLIENT_ID
|
|
GITHUB_CLIENT_SECRET
|
|
|
|
MICROSOFT_CLIENT_ID
|
|
MICROSOFT_CLIENT_SECRET
|
|
```
|
|
|
|
Future use:
|
|
|
|
* Gitea
|
|
* OpenProject
|
|
* Other applications
|
|
|
|
---
|
|
|
|
### DbGate Credential Migration
|
|
|
|
The running DbGate deployment currently has its login credential in the server-side Compose configuration. Move the password to:
|
|
|
|
```text
|
|
/srv/secrets/company.env
|
|
DBGATE_PASSWORD
|
|
```
|
|
|
|
The repository Compose definition already references `DBGATE_PASSWORD` and contains no real password.
|
|
|
|
Status:
|
|
|
|
```text
|
|
Migration pending
|
|
```
|
|
|
|
---
|
|
|
|
## Rules
|
|
|
|
* Never commit secrets to Git.
|
|
* Never store passwords directly in docker-compose files.
|
|
* Never share the contents of company.env.
|
|
* Use environment variables whenever possible.
|
|
* Use `.env.example` files for documentation.
|
|
* Rotate credentials immediately if exposure is suspected.
|
|
|
|
---
|
|
|
|
## Backup Requirements
|
|
|
|
The following file must be included in server backups:
|
|
|
|
```text
|
|
/srv/secrets/company.env
|
|
```
|
|
|
|
Loss of this file may prevent applications from starting correctly.
|
|
|
|
---
|
|
|
|
## Recovery Procedure
|
|
|
|
If the server must be rebuilt:
|
|
|
|
1. Restore `/srv/secrets/company.env`
|
|
2. Verify file permissions
|
|
3. Deploy Docker stacks
|
|
4. Verify services can access required variables
|
|
5. Verify SMTP functionality
|
|
6. Verify database connectivity
|
|
|
|
---
|
|
|
|
## Security Notes
|
|
|
|
The secrets file contains credentials for multiple services.
|
|
|
|
Access should be restricted to system administrators only.
|
|
|
|
Recommended permissions:
|
|
|
|
```bash
|
|
chmod 600 /srv/secrets/company.env
|
|
```
|
|
|
|
Recommended ownership:
|
|
|
|
```bash
|
|
root:root
|
|
```
|
|
|
|
---
|
|
|
|
## Related Documents
|
|
|
|
* docs/email.md
|
|
* docs/security.md
|
|
* docs/server.md
|
|
* docs/backups.md
|