diff --git a/docs/plans/credential-consolidation.md b/docs/plans/credential-consolidation.md new file mode 100644 index 0000000..f9ff46c --- /dev/null +++ b/docs/plans/credential-consolidation.md @@ -0,0 +1,86 @@ +# Yookr credential consolidation + +This inventory contains names and provenance only. It intentionally contains no +credential values or value hashes. + +## Proposed authority + +Use one SOPS-encrypted `~/.config/yookr/credentials.yaml`, backed by the existing +mode-0600 user age identity. SOPS 3.13.3 and the identity are already present, +and an encrypt/decrypt round trip passed on 2026-09-06. + +Keep the document hierarchical so operators can inspect and edit everything in +one place while callers extract only their own scalar values or subtree. Do not +load the complete document into every repository environment. Public endpoints, +queue names, bucket names, and other non-secret configuration remain with their +normal owners. + +Candidate top-level groups: + +- `company-login` +- `databases` +- `leafcloud` +- `rabbitmq` +- `service-accounts` +- `third-party` +- `archive` + +Do not migrate or remove source values until the user approves this authority. +After approval, migrate active credentials first, verify each consumer, then +handle archived credentials and delete redundant plaintext only with explicit +approval. + +## Active sources + +- `~/dev/work/yookr-dashboard/backend/.env`: MySQL, MongoDB, Leafcloud S3, and + logger credentials. +- `~/dev/work/yookr-dashboard/front-end/.env`: `VITE_BASE_TOKEN` is referenced by + frontend source and is therefore client-visible, not a protectable secret. +- `~/dev/work/yookr-data-science/.env`: WeatherAPI key. +- `~/rabbitmq-creds-test`: test RabbitMQ username and password. +- `~/db-creds`: MySQL test/live and MongoDB test/live material. +- `~/dev/work/yookr-api/http-client.private.env.json`: company email and + password used for API logins. +- `~/.local/share/db_ui/connections.json`: existing `traceability` connection. + +All credential-bearing active files above are mode 0600 after the audit. + +## Archived credential sources + +- Service login: `inteerlijn`, `water-need`, `temperature-relay-dendron`, and + `prediction_mildew_rust`. +- Rules service: RabbitMQ and database credentials in `rules-service-hex`. +- Legacy management: database, logger, and local-login credentials. +- Legacy data science and soil-moisture tools: company login credentials. +- `salemans`: CMI credentials. + +These files are now mode 0600. Preserve their provenance under `archive` until +the user decides whether each credential is still valid; stale credentials +should be revoked instead of retained indefinitely. + +## Excluded from migration + +- Tracked `.env.example` files and public URL-only frontend environments. +- Tracked Apache Superset/Hive development defaults. +- Empty placeholders, queue names, ports, bucket names, and service URLs. +- NixOS SOPS secrets and personal Vaultwarden entries, which already have their + own authorities. + +## Observed services + +The scan identified Yookr measurement, authentication, management, aggregation, +rules, prediction, dashboard, and data-science workflows plus MySQL, MongoDB, +RabbitMQ, Leafcloud S3, logger, SMTP, Vonage, TTN, WeatherAPI, CMI, Superset, and +Hive integrations. Presence in an archive does not establish that a service or +credential is still active. + +## Immediate findings + +- The discovered dashboard S3 credential can list eight Leafcloud containers but + cannot see `irristaud`; a credential from the `irristaud` project is required. +- The generated Yookr OpenAPI document remains malformed, but direct requests use + the reviewed local contract and work independently. +- Management accepts an account-issued JWT only as the raw `Authorization` value, + contrary to its current OpenAPI Bearer declaration. +- Herdr issue 197 is suitable for a local planning pilot, but the current Codex + session is not running inside Herdr and must not control it. diff --git a/docs/plans/workflow-system.md b/docs/plans/workflow-system.md index 7150940..6c5daa0 100644 --- a/docs/plans/workflow-system.md +++ b/docs/plans/workflow-system.md @@ -46,7 +46,7 @@ restarted Kitty and closed the user's terminal session. successfully. The labeled RabbitMQ test/live bookmarks are present, and the invocation-scoped test overview and queue listing passed. Test API login, Yookr administrator read, rules read, aggregation login, and management health - passed; the Yookr token is not accepted by management's authenticated API. + passed. Account login plus a raw-token management user read also passed. ## Active pilot gates @@ -61,7 +61,8 @@ These gates do not block work on each other. concrete cross-system investigation gives it durable value. - Keep Bruno, DBeaver, and PIM clients until their separate pilots decide them. - Wait for a real Monday ticket before adding anything beyond native GitHub, - Herdr, Git, and worktree workflows. + Herdr, Git, and worktree workflows. Issue 197 is selected, but this Codex + session is outside Herdr and cannot safely control the pilot. The Herdr pilot passes only when short, long, and approval-blocked sessions have accurate attention state; detach and reattach preserve output; one Claude or Pi @@ -148,6 +149,9 @@ the fresh-shell GitHub read and restarted-Codex Context7 lookup must both work. - The fine-grained GitHub token and Context7 key stay in mode-0600 machine-local files and are exposed only to their callers. Secrets do not enter Nix or broad process environments. +- The value-free credential audit and proposed central SOPS authority are in + [`credential-consolidation.md`](credential-consolidation.md). Do not migrate + plaintext sources until the user accepts the authority and migration order. - `sync/notes` is the single notebook owner. Daily notes, meetings, and raw transcripts have separate paths, and agents do not create issues or ingest transcripts automatically. @@ -168,7 +172,7 @@ the fresh-shell GitHub read and restarted-Codex Context7 lookup must both work. ## Next step -Obtain the four database connection URIs, Leafcloud `irristaud` project S3 -credentials, a management API token, and one real Monday ticket. Then complete -the database/S3 access checks and the real workbench and Herdr pilots without -mutating company GitHub. +Agree on the proposed central SOPS credential authority, obtain Leafcloud S3 +credentials from the `irristaud` project, and resume issue 197 from a Codex +session launched inside Herdr. Then complete database/S3 access checks and the +real workbench and Herdr pilots without mutating company GitHub.