4.5 KiB
Credentials and secrets
Git
Remote is fixed to https://git.cin.su/m/Assistant.git.
The repository can be read externally, but a push may require authentication. First let normal Git credential helpers handle authentication. Do not add username/password to the remote URL.
If authentication is not already configured, ask the user for either:
- a Gitea personal access token with the minimum repository scope, or
- username + token/password if their local setup requires it.
Never store it in Git.
Portainer
Target is https://docker.cin.su.
Preferred automation credential: PORTAINER_API_KEY supplied outside Git. PORTAINER_ENDPOINT_ID may also be required after environment discovery.
Do not guess Portainer credentials and do not search other project source trees for literal passwords. Existing OS/environment secret stores may be used without revealing values.
Production services
Each privileged runtime gets only its required secret/capability bindings. commit-runtime is intentionally isolated from the general Core Runtime.
The Core SELF learning repository uses the existing assistant_core_secrets volume and credential-reference mechanism with self_role and credential://domovoy/self/db-password/v1. The secret is consumed from the fixed /run/secrets/self_db_password path; its value is never placed in Compose environment, Git, logs or ordinary configuration. The role and schema already exist; this wiring does not create a role or broaden privileges.
Delegated non-interactive control-plane work is separately authenticated. The local secret-control-plane one-shot control-plane service provisions control_plane_service_token with crypto/rand into the dedicated external assistant_control_plane_service_secrets volume. The token artifact is mode 0400; metadata and audit are separate protected files and contain no value or reversible fingerprint. Only core-runtime and the existing Authority/Commit runtime mount that volume read-only at /run/control-plane-secrets; no model, Skill, SELF, creator-web, cognitive-worker or research-runtime receives the mount. Compose carries only the non-secret credential reference credential://domovoy/control-plane/service-token/v1.
The provisioner is idempotent: restart reuses an existing safe active artifact. Rotation creates a new value by atomic replacement, records non-secret metadata/audit, and never accepts a plaintext environment variable. The service token is not a Creator session, cannot impersonate a human, and never grants Authority by itself. Removing or rotating the token disables/refreshes service authentication; revoking the durable Authority grant also blocks new delegated operations without deleting audit history.
Creator authentication secrets are stored in the external Docker volume assistant_core_secrets and mounted read-only only at /run/secrets in core-runtime. The production container environment contains _FILE paths, not the secret values. Files are owned by runtime uid 100/gid 101 with mode 0400. CREATOR_USERNAME is not secret and remains an environment value. Development may continue to use direct environment values, but a direct value and its matching _FILE setting must never be configured together.
The PostgreSQL off-host backup passphrase is generated randomly and stored as CurrentUser DPAPI ciphertext at %LOCALAPPDATA%\Domovoy\postgres-backup-key.dpapi.json. An atomic copy of that DPAPI ciphertext, never the plaintext passphrase, is retained at \\nas\MST\codex\_backups\domovoy\keys\postgres-backup-key.dpapi.json. The passphrase is never stored in Git, the production Docker host, a scheduled-task argument, or NAS plaintext. The NAS backup directory receives only GnuPG AES-256 ciphertext and a non-secret integrity manifest. Recovery therefore requires both the NAS artifacts and the authorized Windows DPAPI profile.
Prospective notification delivery uses two unrelated random tokens. The write token is stored only in external Docker volume assistant_notification_writer_secret, mounted read-only into commit-runtime and notification-receiver. The read token is stored in external Docker volume assistant_notification_reader_secret, mounted read-only only into notification-receiver; its workstation copy is CurrentUser DPAPI ciphertext at %LOCALAPPDATA%\Domovoy\notification-receiver-read-key.dpapi.json. Only that ciphertext is backed up to \\nas\MST\codex\_backups\domovoy\keys\notification-receiver-read-key.dpapi.json. Plaintext tokens must not enter compose environment, Git, PostgreSQL, task arguments, logs, browser storage, or NAS.