docs: archive workflow plans and introduce constellation

Preserve the accumulated phase-two record and introduce the constellation design and working agreement. Archived approvals and plans are historical, not current authority.
2026-09-09 17:31:03 +02:00
1 parent 85e4cbdc67
commit 4e3a3ac899
@@ -0,0 +1,116 @@
+# Yookr credential consolidation
+
+Archived: historical credential inventory and migration evidence.
+
+This inventory contains names and provenance only. It intentionally contains no
+credential values or value hashes.
+
+## Authority
+
+Use one SOPS-encrypted `~/.config/yookr/credentials.yaml`, backed by the existing
+mode-0600 user age identity. SOPS 3.13.3 and the identity are already present,
+and an exact encrypt/decrypt comparison passed on 2026-09-06. The user approved
+this authority and an active-credentials-first migration. The directory is mode
+0700 and the encrypted file is mode 0600; it remains outside Git and the Nix
+store.
+
+Keep the document hierarchical so operators can inspect and edit everything in
+one place while callers extract only their own scalar values or subtree. Do not
+load the complete document into every repository environment. Public endpoints,
+queue names, bucket names, and other non-secret configuration remain with their
+normal owners.
+
+Top-level groups:
+
+- `company_login`
+- `databases`
+- `leafcloud`
+- `rabbitmq`
+- `applications`
+- `archive`
+
+Active credentials and ten archived credential sources have been migrated.
+Archive membership does not imply inactivity, so their source namespaces are
+preserved. Delete redundant plaintext only with explicit approval after each
+original consumer is verified.
+
+## Active sources
+
+- `~/dev/work/yookr-dashboard/backend/.env`: MySQL, MongoDB, Leafcloud S3, and
+  logger credentials.
+- `~/dev/work/yookr-dashboard/front-end/.env`: `VITE_BASE_TOKEN` is referenced by
+  frontend source and is therefore client-visible, not a protectable secret.
+- `~/dev/work/yookr-data-science/.env`: WeatherAPI key.
+- `~/rabbitmq-creds-test`: test RabbitMQ username and password.
+- `~/irristaud-openstack-creds`: Irristaud project EC2 credentials.
+- `~/db-creds`: MySQL test/live and MongoDB test/live material.
+- `~/dev/work/yookr-api/http-client.private.env.json`: company email and
+  password used for API logins.
+- `~/.local/share/db_ui/connections.json`: existing `traceability` connection.
+
+All credential-bearing active files above are mode 0600 after the audit.
+They remain in place pending consumer-by-consumer removal approval. The dashboard
+backend's MySQL and MongoDB credentials do not match either named test/live pair,
+so they are preserved separately instead of being assigned an environment by
+assumption.
+
+## Archived credential sources
+
+- Service login: `inteerlijn`, `water-need`, `temperature-relay-dendron`, and
+  `prediction_mildew_rust`.
+- Rules service: RabbitMQ and database credentials in `rules-service-hex`.
+- Legacy management: database, logger, and local-login credentials.
+- Legacy data science and soil-moisture tools: company login credentials.
+- `salemans`: CMI credentials.
+
+These files are now mode 0600 and their selected credentials are preserved under
+`archive`. The user is still cleaning the filesystem, so stale status must be
+decided per source; stale credentials should be revoked instead of retained
+indefinitely.
+
+## Verified consumers
+
+- `yookr-workbench` decrypts once in memory and exports only its API login, four
+  database connections, Irristaud S3 credential, and test RabbitMQ credential.
+- Central test API login and the read-only RabbitMQ overview passed.
+- MariaDB test/live example queries and MongoDB test/live example scripts passed.
+  Both MariaDB sessions negotiated TLS 1.3. The routers expose auto-generated
+  certificates from unavailable private CAs without valid host identities, so
+  only these two URLs disable certificate verification. The MongoDB endpoints
+  publish SRV rather than direct address records and therefore use `mongodb+srv`
+  URLs.
+- The ephemeral `irristaud:` rclone remote found the sole `irristaud` container
+  and listed its six root entries. No object content was downloaded and no
+  rclone configuration was persisted.
+
+Dadbod's four display names are active, both MongoDB connections work, both
+MariaDB examples produce results through Dadbod UI, and the workbench environment
+supplies successful Kulala response chaining.
+
+## Excluded from migration
+
+- Tracked `.env.example` files and public URL-only frontend environments.
+- Tracked Apache Superset/Hive development defaults.
+- Empty placeholders, queue names, ports, bucket names, and service URLs.
+- NixOS SOPS secrets and personal Vaultwarden entries, which already have their
+  own authorities.
+
+## Observed services
+
+The scan identified Yookr measurement, authentication, management, aggregation,
+rules, prediction, dashboard, and data-science workflows plus MySQL, MongoDB,
+RabbitMQ, Leafcloud S3, logger, SMTP, Vonage, TTN, WeatherAPI, CMI, Superset, and
+Hive integrations. Presence in an archive does not establish that a service or
+credential is still active.
+
+## Immediate findings
+
+- The dashboard S3 credential and the Irristaud project credential are distinct;
+  the latter is now centralized and its read-only pilot passed.
+- The generated Yookr OpenAPI document remains malformed, but direct requests use
+  the reviewed local contract and work independently.
+- Management accepts an account-issued JWT only as the raw `Authorization` value,
+  contrary to its current OpenAPI Bearer declaration.
+- The Herdr issue 197 pilot produced local-only frontend and backend planning
+  commits without touching company GitHub. Both identify the separate account
+  service, not `yookr-dashboard`, as the implementation owner.