# Yookr credential consolidation

This inventory contains names and provenance only. It intentionally contains no
credential values or value hashes.

## Proposed authority

Use one SOPS-encrypted `~/.config/yookr/credentials.yaml`, backed by the existing
mode-0600 user age identity. SOPS 3.13.3 and the identity are already present,
and an encrypt/decrypt round trip passed on 2026-09-06.

Keep the document hierarchical so operators can inspect and edit everything in
one place while callers extract only their own scalar values or subtree. Do not
load the complete document into every repository environment. Public endpoints,
queue names, bucket names, and other non-secret configuration remain with their
normal owners.

Candidate top-level groups:

- `company-login`
- `databases`
- `leafcloud`
- `rabbitmq`
- `service-accounts`
- `third-party`
- `archive`

Do not migrate or remove source values until the user approves this authority.
After approval, migrate active credentials first, verify each consumer, then
handle archived credentials and delete redundant plaintext only with explicit
approval.

## Active sources

- `~/dev/work/yookr-dashboard/backend/.env`: MySQL, MongoDB, Leafcloud S3, and
  logger credentials.
- `~/dev/work/yookr-dashboard/front-end/.env`: `VITE_BASE_TOKEN` is referenced by
  frontend source and is therefore client-visible, not a protectable secret.
- `~/dev/work/yookr-data-science/.env`: WeatherAPI key.
- `~/rabbitmq-creds-test`: test RabbitMQ username and password.
- `~/db-creds`: MySQL test/live and MongoDB test/live material.
- `~/dev/work/yookr-api/http-client.private.env.json`: company email and
  password used for API logins.
- `~/.local/share/db_ui/connections.json`: existing `traceability` connection.

All credential-bearing active files above are mode 0600 after the audit.

## Archived credential sources

- Service login: `inteerlijn`, `water-need`, `temperature-relay-dendron`, and
  `prediction_mildew_rust`.
- Rules service: RabbitMQ and database credentials in `rules-service-hex`.
- Legacy management: database, logger, and local-login credentials.
- Legacy data science and soil-moisture tools: company login credentials.
- `salemans`: CMI credentials.

These files are now mode 0600. Preserve their provenance under `archive` until
the user decides whether each credential is still valid; stale credentials
should be revoked instead of retained indefinitely.

## Excluded from migration

- Tracked `.env.example` files and public URL-only frontend environments.
- Tracked Apache Superset/Hive development defaults.
- Empty placeholders, queue names, ports, bucket names, and service URLs.
- NixOS SOPS secrets and personal Vaultwarden entries, which already have their
  own authorities.

## Observed services

The scan identified Yookr measurement, authentication, management, aggregation,
rules, prediction, dashboard, and data-science workflows plus MySQL, MongoDB,
RabbitMQ, Leafcloud S3, logger, SMTP, Vonage, TTN, WeatherAPI, CMI, Superset, and
Hive integrations. Presence in an archive does not establish that a service or
credential is still active.

## Immediate findings

- The discovered dashboard S3 credential can list eight Leafcloud containers but
  cannot see `irristaud`; a credential from the `irristaud` project is required.
- The generated Yookr OpenAPI document remains malformed, but direct requests use
  the reviewed local contract and work independently.
- Management accepts an account-issued JWT only as the raw `Authorization` value,
  contrary to its current OpenAPI Bearer declaration.
- Herdr issue 197 is suitable for a local planning pilot, but the current Codex
  session is not running inside Herdr and must not control it.