lux/docs/plans/credential-consolidation.md

Yookr credential consolidation

This inventory contains names and provenance only. It intentionally contains no credential values or value hashes.

Authority

Use one SOPS-encrypted ~/.config/yookr/credentials.yaml, backed by the existing mode-0600 user age identity. SOPS 3.13.3 and the identity are already present, and an exact encrypt/decrypt comparison passed on 2026-09-06. The user approved this authority and an active-credentials-first migration. The directory is mode 0700 and the encrypted file is mode 0600; it remains outside Git and the Nix store.

Keep the document hierarchical so operators can inspect and edit everything in one place while callers extract only their own scalar values or subtree. Do not load the complete document into every repository environment. Public endpoints, queue names, bucket names, and other non-secret configuration remain with their normal owners.

Top-level groups:

• company_login
• databases
• leafcloud
• rabbitmq
• applications
• archive

Active credentials and ten archived credential sources have been migrated. Archive membership does not imply inactivity, so their source namespaces are preserved. Delete redundant plaintext only with explicit approval after each original consumer is verified.

Active sources

• ~/dev/work/yookr-dashboard/backend/.env: MySQL, MongoDB, Leafcloud S3, and logger credentials.
• ~/dev/work/yookr-dashboard/front-end/.env: VITE_BASE_TOKEN is referenced by frontend source and is therefore client-visible, not a protectable secret.
• ~/dev/work/yookr-data-science/.env: WeatherAPI key.
• ~/rabbitmq-creds-test: test RabbitMQ username and password.
• ~/irristaud-openstack-creds: Irristaud project EC2 credentials.
• ~/db-creds: MySQL test/live and MongoDB test/live material.
• ~/dev/work/yookr-api/http-client.private.env.json: company email and password used for API logins.
• ~/.local/share/db_ui/connections.json: existing traceability connection.

All credential-bearing active files above are mode 0600 after the audit. They remain in place pending consumer-by-consumer removal approval. The dashboard backend's MySQL and MongoDB credentials do not match either named test/live pair, so they are preserved separately instead of being assigned an environment by assumption.

Archived credential sources

• Service login: inteerlijn, water-need, temperature-relay-dendron, and prediction_mildew_rust.
• Rules service: RabbitMQ and database credentials in rules-service-hex.
• Legacy management: database, logger, and local-login credentials.
• Legacy data science and soil-moisture tools: company login credentials.
• salemans: CMI credentials.

These files are now mode 0600 and their selected credentials are preserved under archive. The user is still cleaning the filesystem, so stale status must be decided per source; stale credentials should be revoked instead of retained indefinitely.

Verified consumers

• yookr-workbench decrypts once in memory and exports only its API login, four database connections, Irristaud S3 credential, and test RabbitMQ credential.
• Central test API login and the read-only RabbitMQ overview passed.
• MariaDB test/live example queries and MongoDB test/live example scripts passed. Both MariaDB sessions negotiated TLS 1.3. The routers expose auto-generated certificates from unavailable private CAs without valid host identities, so only these two URLs disable certificate verification. The MongoDB endpoints publish SRV rather than direct address records and therefore use mongodb+srv URLs.
• The ephemeral irristaud: rclone remote found the sole irristaud container and listed its six root entries. No object content was downloaded and no rclone configuration was persisted.

Dadbod's four display names are active, both MongoDB connections work, and the workbench environment now supplies successful Kulala response chaining. The two MariaDB examples still need visual confirmation in Dadbod.

Excluded from migration

• Tracked .env.example files and public URL-only frontend environments.
• Tracked Apache Superset/Hive development defaults.
• Empty placeholders, queue names, ports, bucket names, and service URLs.
• NixOS SOPS secrets and personal Vaultwarden entries, which already have their own authorities.

Observed services

The scan identified Yookr measurement, authentication, management, aggregation, rules, prediction, dashboard, and data-science workflows plus MySQL, MongoDB, RabbitMQ, Leafcloud S3, logger, SMTP, Vonage, TTN, WeatherAPI, CMI, Superset, and Hive integrations. Presence in an archive does not establish that a service or credential is still active.

Immediate findings

• The dashboard S3 credential and the Irristaud project credential are distinct; the latter is now centralized and its read-only pilot passed.
• The generated Yookr OpenAPI document remains malformed, but direct requests use the reviewed local contract and work independently.
• Management accepts an account-issued JWT only as the raw Authorization value, contrary to its current OpenAPI Bearer declaration.
• The Herdr issue 197 pilot produced local-only frontend and backend planning commits without touching company GitHub. Both identify the separate account service, not yookr-dashboard, as the implementation owner.