249 lines
4.3 KiB
Markdown
249 lines
4.3 KiB
Markdown
# Secrets Management
|
|
|
|
## Overview
|
|
|
|
SilverLinux uses Infisical for centralized secret management. Secrets are injected into standard Compose stacks at runtime by `slcompose`, which wraps `infisical run`.
|
|
|
|
This repository no longer depends on a local `/srv/secrets/company.env` file for deployed services. If that file still exists on the server, remove it after confirming all required values are present in Infisical.
|
|
|
|
Sentry is the only documented exception to the standard pattern. It follows the upstream self-hosted Sentry installation model because it is a much larger multi-service application.
|
|
|
|
---
|
|
|
|
## Purpose
|
|
|
|
The Infisical deployment flow provides a single source of truth for:
|
|
|
|
* SMTP credentials
|
|
* Database passwords
|
|
* Application secrets
|
|
* OAuth client secrets
|
|
* Future API keys
|
|
|
|
Applications should load secrets using Infisical injection at deployment time through `slcompose`.
|
|
|
|
Example:
|
|
|
|
```bash
|
|
slcompose up gitea
|
|
```
|
|
|
|
---
|
|
|
|
## Current Variables
|
|
|
|
### Email
|
|
|
|
```text
|
|
SMTP_HOST
|
|
SMTP_PORT
|
|
SMTP_USERNAME
|
|
SMTP_PASSWORD
|
|
```
|
|
|
|
Used by:
|
|
|
|
* Gitea
|
|
* OpenProject
|
|
* Future services
|
|
|
|
---
|
|
|
|
### PostgreSQL
|
|
|
|
```text
|
|
POSTGRES_ROOT_PASSWORD
|
|
POSTGRES_OPENPROJECT_PASSWORD
|
|
```
|
|
|
|
Used by:
|
|
|
|
* PostgreSQL
|
|
* OpenProject
|
|
* Gitea
|
|
|
|
---
|
|
|
|
### Microsoft SQL Server
|
|
|
|
```text
|
|
MSSQL_SA_PASSWORD
|
|
```
|
|
|
|
Used by:
|
|
|
|
* Microsoft SQL Server 2022 Express
|
|
* DbGate's MSSQL connection
|
|
|
|
---
|
|
|
|
### OpenProject
|
|
|
|
```text
|
|
OPENPROJECT_SECRET_KEY_BASE
|
|
```
|
|
|
|
Used by:
|
|
|
|
* OpenProject
|
|
|
|
---
|
|
|
|
### Gitea Actions Runner
|
|
|
|
```text
|
|
GITEA_RUNNER_REGISTRATION_TOKEN
|
|
```
|
|
|
|
Used by:
|
|
|
|
* The global `silverlinux-runner`
|
|
* Runner registration and reconnection
|
|
|
|
Repository workflow credentials, including `BAGET_API_KEY`, are stored in Gitea under **Repository Settings -> Actions -> Secrets** and are not stored in repositories.
|
|
|
|
---
|
|
|
|
### Jitsi
|
|
|
|
```text
|
|
JICOFO_AUTH_PASSWORD
|
|
JVB_AUTH_PASSWORD
|
|
JIBRI_XMPP_PASSWORD
|
|
JIBRI_RECORDER_PASSWORD
|
|
JIGASI_XMPP_PASSWORD
|
|
JIGASI_TRANSCRIBER_PASSWORD
|
|
```
|
|
|
|
Used by:
|
|
|
|
* Jitsi Meet
|
|
|
|
---
|
|
|
|
### Nextcloud
|
|
|
|
```text
|
|
NEXTCLOUD_ADMIN_USER
|
|
NEXTCLOUD_ADMIN_PASSWORD
|
|
POSTGRES_DB
|
|
POSTGRES_USER
|
|
POSTGRES_PASSWORD
|
|
SMTP_HOST
|
|
SMTP_PORT
|
|
SMTP_USERNAME
|
|
SMTP_PASSWORD
|
|
```
|
|
|
|
Used by:
|
|
|
|
* Nextcloud
|
|
* Nextcloud PostgreSQL
|
|
* Nextcloud notification email
|
|
|
|
Infisical path:
|
|
|
|
```text
|
|
/nextcloud
|
|
```
|
|
|
|
Notes:
|
|
|
|
* The 2026-07-08 runtime snapshot showed `/srv/docker/nextcloud/.env` present on the server.
|
|
* Do not commit the raw `.env` file or `config.php`.
|
|
* `config.php` includes high-sensitivity values such as `secret`, `passwordsalt`, database credentials and SMTP credentials.
|
|
|
|
---
|
|
|
|
### Future OAuth
|
|
|
|
```text
|
|
GOOGLE_CLIENT_ID
|
|
GOOGLE_CLIENT_SECRET
|
|
|
|
GITHUB_CLIENT_ID
|
|
GITHUB_CLIENT_SECRET
|
|
|
|
MICROSOFT_CLIENT_ID
|
|
MICROSOFT_CLIENT_SECRET
|
|
```
|
|
|
|
Future use:
|
|
|
|
* Gitea
|
|
* OpenProject
|
|
* Other applications
|
|
|
|
---
|
|
|
|
### Sentry Exception
|
|
|
|
```text
|
|
Sentry self-hosted installer secrets
|
|
```
|
|
|
|
Used by:
|
|
|
|
* Sentry
|
|
|
|
Notes:
|
|
|
|
* Sentry does not follow the same simple `slcompose` + Infisical pattern as the other SilverLinux services.
|
|
* Keep Sentry secrets out of this repository.
|
|
* Document any Sentry-specific backup or restore requirements in [docs/sentry.md](sentry.md).
|
|
|
|
---
|
|
|
|
## Rules
|
|
|
|
* Never commit secrets to Git.
|
|
* Never store passwords directly in docker-compose files.
|
|
* Never share Infisical exports, tokens or raw service `.env` files.
|
|
* Use environment variables whenever possible.
|
|
* Use `.env.example` files for documentation.
|
|
* Rotate credentials immediately if exposure is suspected.
|
|
|
|
---
|
|
|
|
## Backup Requirements
|
|
|
|
Backups must preserve the ability to recover Infisical-managed secrets.
|
|
|
|
```text
|
|
Infisical project data and service secret paths
|
|
```
|
|
|
|
Loss of the Infisical secret source may prevent applications from starting correctly.
|
|
|
|
---
|
|
|
|
## Recovery Procedure
|
|
|
|
If the server must be rebuilt:
|
|
|
|
1. Restore or reauthorize Infisical access.
|
|
2. Verify `/etc/infisical/token` and any required Infisical domain configuration.
|
|
3. Deploy Docker stacks through `slcompose`.
|
|
4. Verify services can access required variables.
|
|
5. Verify SMTP functionality.
|
|
6. Verify database connectivity.
|
|
|
|
---
|
|
|
|
## Security Notes
|
|
|
|
Infisical contains credentials for multiple services.
|
|
|
|
Access should be restricted to system administrators only.
|
|
|
|
The local Infisical token under `/etc/infisical/token` must be protected with root-only permissions.
|
|
|
|
---
|
|
|
|
## Related Documents
|
|
|
|
* docs/email.md
|
|
* docs/security.md
|
|
* docs/server.md
|
|
* docs/backups.md
|