# Credentials and secrets

## Git
Remote is fixed to `https://git.cin.su/m/Assistant.git`.

The repository can be read externally, but a push may require authentication. First let normal Git credential helpers handle authentication. Do not add username/password to the remote URL.

If authentication is not already configured, ask the user for either:
- a Gitea personal access token with the minimum repository scope, or
- username + token/password if their local setup requires it.

Never store it in Git.

## Portainer
Target is `https://docker.cin.su`.

Preferred automation credential: `PORTAINER_API_KEY` supplied outside Git. `PORTAINER_ENDPOINT_ID` may also be required after environment discovery.

Do not guess Portainer credentials and do not search other project source trees for literal passwords. Existing OS/environment secret stores may be used without revealing values.

## Production services
Each privileged runtime gets only its required secret/capability bindings. `commit-runtime` is intentionally isolated from the general Core Runtime.

Creator authentication secrets are stored in the external Docker volume `assistant_core_secrets` and mounted read-only only at `/run/secrets` in `core-runtime`. The production container environment contains `_FILE` paths, not the secret values. Files are owned by runtime uid 100/gid 101 with mode 0400. `CREATOR_USERNAME` is not secret and remains an environment value. Development may continue to use direct environment values, but a direct value and its matching `_FILE` setting must never be configured together.

The PostgreSQL off-host backup passphrase is generated randomly and stored as CurrentUser DPAPI ciphertext at `%LOCALAPPDATA%\Domovoy\postgres-backup-key.dpapi.json`. An atomic copy of that DPAPI ciphertext, never the plaintext passphrase, is retained at `\\nas\MST\codex\_backups\domovoy\keys\postgres-backup-key.dpapi.json`. The passphrase is never stored in Git, the production Docker host, a scheduled-task argument, or NAS plaintext. The NAS backup directory receives only GnuPG AES-256 ciphertext and a non-secret integrity manifest. Recovery therefore requires both the NAS artifacts and the authorized Windows DPAPI profile.