# Yookr credential consolidation

This inventory contains names and provenance only. It intentionally contains no
credential values or value hashes.

## Authority

Use one SOPS-encrypted `~/.config/yookr/credentials.yaml`, backed by the existing
mode-0600 user age identity. SOPS 3.13.3 and the identity are already present,
and an exact encrypt/decrypt comparison passed on 2026-09-06. The user approved
this authority and an active-credentials-first migration. The directory is mode
0700 and the encrypted file is mode 0600; it remains outside Git and the Nix
store.

Keep the document hierarchical so operators can inspect and edit everything in
one place while callers extract only their own scalar values or subtree. Do not
load the complete document into every repository environment. Public endpoints,
queue names, bucket names, and other non-secret configuration remain with their
normal owners.

Top-level groups:

- `company_login`
- `databases`
- `leafcloud`
- `rabbitmq`
- `applications`
- `archive`

Active credentials and ten archived credential sources have been migrated.
Archive membership does not imply inactivity, so their source namespaces are
preserved. Delete redundant plaintext only with explicit approval after each
original consumer is verified.

## Active sources

- `~/dev/work/yookr-dashboard/backend/.env`: MySQL, MongoDB, Leafcloud S3, and
  logger credentials.
- `~/dev/work/yookr-dashboard/front-end/.env`: `VITE_BASE_TOKEN` is referenced by
  frontend source and is therefore client-visible, not a protectable secret.
- `~/dev/work/yookr-data-science/.env`: WeatherAPI key.
- `~/rabbitmq-creds-test`: test RabbitMQ username and password.
- `~/irristaud-openstack-creds`: Irristaud project EC2 credentials.
- `~/db-creds`: MySQL test/live and MongoDB test/live material.
- `~/dev/work/yookr-api/http-client.private.env.json`: company email and
  password used for API logins.
- `~/.local/share/db_ui/connections.json`: existing `traceability` connection.

All credential-bearing active files above are mode 0600 after the audit.
They remain in place pending consumer-by-consumer removal approval. The dashboard
backend's MySQL and MongoDB credentials do not match either named test/live pair,
so they are preserved separately instead of being assigned an environment by
assumption.

## Archived credential sources

- Service login: `inteerlijn`, `water-need`, `temperature-relay-dendron`, and
  `prediction_mildew_rust`.
- Rules service: RabbitMQ and database credentials in `rules-service-hex`.
- Legacy management: database, logger, and local-login credentials.
- Legacy data science and soil-moisture tools: company login credentials.
- `salemans`: CMI credentials.

These files are now mode 0600 and their selected credentials are preserved under
`archive`. The user is still cleaning the filesystem, so stale status must be
decided per source; stale credentials should be revoked instead of retained
indefinitely.

## Verified consumers

- `yookr-workbench` decrypts once in memory and exports only its API login, four
  database connections, Irristaud S3 credential, and test RabbitMQ credential.
- Central test API login and the read-only RabbitMQ overview passed.
- MariaDB test/live example queries and MongoDB test/live example scripts passed.
  Both MariaDB sessions negotiated TLS 1.3. The routers expose auto-generated
  certificates from unavailable private CAs without valid host identities, so
  only these two URLs disable certificate verification. The MongoDB endpoints
  publish SRV rather than direct address records and therefore use `mongodb+srv`
  URLs.
- The ephemeral `irristaud:` rclone remote found the sole `irristaud` container
  and listed its six root entries. No object content was downloaded and no
  rclone configuration was persisted.

Dadbod's four display names are active, both MongoDB connections work, both
MariaDB examples produce results through Dadbod UI, and the workbench environment
supplies successful Kulala response chaining.

## Excluded from migration

- Tracked `.env.example` files and public URL-only frontend environments.
- Tracked Apache Superset/Hive development defaults.
- Empty placeholders, queue names, ports, bucket names, and service URLs.
- NixOS SOPS secrets and personal Vaultwarden entries, which already have their
  own authorities.

## Observed services

The scan identified Yookr measurement, authentication, management, aggregation,
rules, prediction, dashboard, and data-science workflows plus MySQL, MongoDB,
RabbitMQ, Leafcloud S3, logger, SMTP, Vonage, TTN, WeatherAPI, CMI, Superset, and
Hive integrations. Presence in an archive does not establish that a service or
credential is still active.

## Immediate findings

- The dashboard S3 credential and the Irristaud project credential are distinct;
  the latter is now centralized and its read-only pilot passed.
- The generated Yookr OpenAPI document remains malformed, but direct requests use
  the reviewed local contract and work independently.
- Management accepts an account-issued JWT only as the raw `Authorization` value,
  contrary to its current OpenAPI Bearer declaration.
- The Herdr issue 197 pilot produced local-only frontend and backend planning
  commits without touching company GitHub. Both identify the separate account
  service, not `yookr-dashboard`, as the implementation owner.