2.9 KiB
Credentials and secrets
Git
Remote is fixed to https://git.cin.su/m/Assistant.git.
The repository can be read externally, but a push may require authentication. First let normal Git credential helpers handle authentication. Do not add username/password to the remote URL.
If authentication is not already configured, ask the user for either:
- a Gitea personal access token with the minimum repository scope, or
- username + token/password if their local setup requires it.
Never store it in Git.
Portainer
Target is https://docker.cin.su.
Preferred automation credential: PORTAINER_API_KEY supplied outside Git. PORTAINER_ENDPOINT_ID may also be required after environment discovery.
Do not guess Portainer credentials and do not search other project source trees for literal passwords. Existing OS/environment secret stores may be used without revealing values.
Production services
Each privileged runtime gets only its required secret/capability bindings. commit-runtime is intentionally isolated from the general Core Runtime.
Creator authentication secrets are stored in the external Docker volume assistant_core_secrets and mounted read-only only at /run/secrets in core-runtime. The production container environment contains _FILE paths, not the secret values. Files are owned by runtime uid 100/gid 101 with mode 0400. CREATOR_USERNAME is not secret and remains an environment value. Development may continue to use direct environment values, but a direct value and its matching _FILE setting must never be configured together.
The PostgreSQL off-host backup passphrase is generated randomly and stored as CurrentUser DPAPI ciphertext at %LOCALAPPDATA%\Domovoy\postgres-backup-key.dpapi.json. An atomic copy of that DPAPI ciphertext, never the plaintext passphrase, is retained at \\nas\MST\codex\_backups\domovoy\keys\postgres-backup-key.dpapi.json. The passphrase is never stored in Git, the production Docker host, a scheduled-task argument, or NAS plaintext. The NAS backup directory receives only GnuPG AES-256 ciphertext and a non-secret integrity manifest. Recovery therefore requires both the NAS artifacts and the authorized Windows DPAPI profile.
Prospective notification delivery uses two unrelated random tokens. The write token is stored only in external Docker volume assistant_notification_writer_secret, mounted read-only into commit-runtime and notification-receiver. The read token is stored in external Docker volume assistant_notification_reader_secret, mounted read-only only into notification-receiver; its workstation copy is CurrentUser DPAPI ciphertext at %LOCALAPPDATA%\Domovoy\notification-receiver-read-key.dpapi.json. Only that ciphertext is backed up to \\nas\MST\codex\_backups\domovoy\keys\notification-receiver-read-key.dpapi.json. Plaintext tokens must not enter compose environment, Git, PostgreSQL, task arguments, logs, browser storage, or NAS.