115 lines
5.2 KiB
Markdown
115 lines
5.2 KiB
Markdown
# Yookr credential consolidation
|
|
|
|
This inventory contains names and provenance only. It intentionally contains no
|
|
credential values or value hashes.
|
|
|
|
## Authority
|
|
|
|
Use one SOPS-encrypted `~/.config/yookr/credentials.yaml`, backed by the existing
|
|
mode-0600 user age identity. SOPS 3.13.3 and the identity are already present,
|
|
and an exact encrypt/decrypt comparison passed on 2026-09-06. The user approved
|
|
this authority and an active-credentials-first migration. The directory is mode
|
|
0700 and the encrypted file is mode 0600; it remains outside Git and the Nix
|
|
store.
|
|
|
|
Keep the document hierarchical so operators can inspect and edit everything in
|
|
one place while callers extract only their own scalar values or subtree. Do not
|
|
load the complete document into every repository environment. Public endpoints,
|
|
queue names, bucket names, and other non-secret configuration remain with their
|
|
normal owners.
|
|
|
|
Top-level groups:
|
|
|
|
- `company_login`
|
|
- `databases`
|
|
- `leafcloud`
|
|
- `rabbitmq`
|
|
- `applications`
|
|
- `archive`
|
|
|
|
Active credentials and ten archived credential sources have been migrated.
|
|
Archive membership does not imply inactivity, so their source namespaces are
|
|
preserved. Delete redundant plaintext only with explicit approval after each
|
|
original consumer is verified.
|
|
|
|
## Active sources
|
|
|
|
- `~/dev/work/yookr-dashboard/backend/.env`: MySQL, MongoDB, Leafcloud S3, and
|
|
logger credentials.
|
|
- `~/dev/work/yookr-dashboard/front-end/.env`: `VITE_BASE_TOKEN` is referenced by
|
|
frontend source and is therefore client-visible, not a protectable secret.
|
|
- `~/dev/work/yookr-data-science/.env`: WeatherAPI key.
|
|
- `~/rabbitmq-creds-test`: test RabbitMQ username and password.
|
|
- `~/irristaud-openstack-creds`: Irristaud project EC2 credentials.
|
|
- `~/db-creds`: MySQL test/live and MongoDB test/live material.
|
|
- `~/dev/work/yookr-api/http-client.private.env.json`: company email and
|
|
password used for API logins.
|
|
- `~/.local/share/db_ui/connections.json`: existing `traceability` connection.
|
|
|
|
All credential-bearing active files above are mode 0600 after the audit.
|
|
They remain in place pending consumer-by-consumer removal approval. The dashboard
|
|
backend's MySQL and MongoDB credentials do not match either named test/live pair,
|
|
so they are preserved separately instead of being assigned an environment by
|
|
assumption.
|
|
|
|
## Archived credential sources
|
|
|
|
- Service login: `inteerlijn`, `water-need`, `temperature-relay-dendron`, and
|
|
`prediction_mildew_rust`.
|
|
- Rules service: RabbitMQ and database credentials in `rules-service-hex`.
|
|
- Legacy management: database, logger, and local-login credentials.
|
|
- Legacy data science and soil-moisture tools: company login credentials.
|
|
- `salemans`: CMI credentials.
|
|
|
|
These files are now mode 0600 and their selected credentials are preserved under
|
|
`archive`. The user is still cleaning the filesystem, so stale status must be
|
|
decided per source; stale credentials should be revoked instead of retained
|
|
indefinitely.
|
|
|
|
## Verified consumers
|
|
|
|
- `yookr-workbench` decrypts once in memory and exports only its API login, four
|
|
database connections, Irristaud S3 credential, and test RabbitMQ credential.
|
|
- Central test API login and the read-only RabbitMQ overview passed.
|
|
- MariaDB test/live example queries and MongoDB test/live example scripts passed.
|
|
Both MariaDB sessions negotiated TLS 1.3. The routers expose auto-generated
|
|
certificates from unavailable private CAs without valid host identities, so
|
|
only these two URLs disable certificate verification. The MongoDB endpoints
|
|
publish SRV rather than direct address records and therefore use `mongodb+srv`
|
|
URLs.
|
|
- The ephemeral `irristaud:` rclone remote found the sole `irristaud` container
|
|
and listed its six root entries. No object content was downloaded and no
|
|
rclone configuration was persisted.
|
|
|
|
Dadbod's four display names are active and both MongoDB connections work. The
|
|
changed workbench `.envrc` still needs explicit re-authorization before the user
|
|
visually confirms the MariaDB fix.
|
|
|
|
## Excluded from migration
|
|
|
|
- Tracked `.env.example` files and public URL-only frontend environments.
|
|
- Tracked Apache Superset/Hive development defaults.
|
|
- Empty placeholders, queue names, ports, bucket names, and service URLs.
|
|
- NixOS SOPS secrets and personal Vaultwarden entries, which already have their
|
|
own authorities.
|
|
|
|
## Observed services
|
|
|
|
The scan identified Yookr measurement, authentication, management, aggregation,
|
|
rules, prediction, dashboard, and data-science workflows plus MySQL, MongoDB,
|
|
RabbitMQ, Leafcloud S3, logger, SMTP, Vonage, TTN, WeatherAPI, CMI, Superset, and
|
|
Hive integrations. Presence in an archive does not establish that a service or
|
|
credential is still active.
|
|
|
|
## Immediate findings
|
|
|
|
- The dashboard S3 credential and the Irristaud project credential are distinct;
|
|
the latter is now centralized and its read-only pilot passed.
|
|
- The generated Yookr OpenAPI document remains malformed, but direct requests use
|
|
the reviewed local contract and work independently.
|
|
- Management accepts an account-issued JWT only as the raw `Authorization` value,
|
|
contrary to its current OpenAPI Bearer declaration.
|
|
- The Herdr issue 197 pilot produced local-only frontend and backend planning
|
|
commits without touching company GitHub. Both identify the separate account
|
|
service, not `yookr-dashboard`, as the implementation owner.
|