2.2 KiB
Credentials and secrets
Git
Remote is fixed to https://git.cin.su/m/Assistant.git.
The repository can be read externally, but a push may require authentication. First let normal Git credential helpers handle authentication. Do not add username/password to the remote URL.
If authentication is not already configured, ask the user for either:
- a Gitea personal access token with the minimum repository scope, or
- username + token/password if their local setup requires it.
Never store it in Git.
Portainer
Target is https://docker.cin.su.
Preferred automation credential: PORTAINER_API_KEY supplied outside Git. PORTAINER_ENDPOINT_ID may also be required after environment discovery.
Do not guess Portainer credentials and do not search other project source trees for literal passwords. Existing OS/environment secret stores may be used without revealing values.
Production services
Each privileged runtime gets only its required secret/capability bindings. commit-runtime is intentionally isolated from the general Core Runtime.
Creator authentication secrets are stored in the external Docker volume assistant_core_secrets and mounted read-only only at /run/secrets in core-runtime. The production container environment contains _FILE paths, not the secret values. Files are owned by runtime uid 100/gid 101 with mode 0400. CREATOR_USERNAME is not secret and remains an environment value. Development may continue to use direct environment values, but a direct value and its matching _FILE setting must never be configured together.
The PostgreSQL off-host backup passphrase is generated randomly and stored as CurrentUser DPAPI ciphertext at %LOCALAPPDATA%\Domovoy\postgres-backup-key.dpapi.json. An atomic copy of that DPAPI ciphertext, never the plaintext passphrase, is retained at \\nas\MST\codex\_backups\domovoy\keys\postgres-backup-key.dpapi.json. The passphrase is never stored in Git, the production Docker host, a scheduled-task argument, or NAS plaintext. The NAS backup directory receives only GnuPG AES-256 ciphertext and a non-secret integrity manifest. Recovery therefore requires both the NAS artifacts and the authorized Windows DPAPI profile.