lux/docs/plans/credential-consolidation.md

Yookr credential consolidation

This inventory contains names and provenance only. It intentionally contains no credential values or value hashes.

Proposed authority

Use one SOPS-encrypted ~/.config/yookr/credentials.yaml, backed by the existing mode-0600 user age identity. SOPS 3.13.3 and the identity are already present, and an encrypt/decrypt round trip passed on 2026-09-06.

Keep the document hierarchical so operators can inspect and edit everything in one place while callers extract only their own scalar values or subtree. Do not load the complete document into every repository environment. Public endpoints, queue names, bucket names, and other non-secret configuration remain with their normal owners.

Candidate top-level groups:

• company-login
• databases
• leafcloud
• rabbitmq
• service-accounts
• third-party
• archive

Do not migrate or remove source values until the user approves this authority. After approval, migrate active credentials first, verify each consumer, then handle archived credentials and delete redundant plaintext only with explicit approval.

Active sources

• ~/dev/work/yookr-dashboard/backend/.env: MySQL, MongoDB, Leafcloud S3, and logger credentials.
• ~/dev/work/yookr-dashboard/front-end/.env: VITE_BASE_TOKEN is referenced by frontend source and is therefore client-visible, not a protectable secret.
• ~/dev/work/yookr-data-science/.env: WeatherAPI key.
• ~/rabbitmq-creds-test: test RabbitMQ username and password.
• ~/db-creds: MySQL test/live and MongoDB test/live material.
• ~/dev/work/yookr-api/http-client.private.env.json: company email and password used for API logins.
• ~/.local/share/db_ui/connections.json: existing traceability connection.

All credential-bearing active files above are mode 0600 after the audit.

Archived credential sources

• Service login: inteerlijn, water-need, temperature-relay-dendron, and prediction_mildew_rust.
• Rules service: RabbitMQ and database credentials in rules-service-hex.
• Legacy management: database, logger, and local-login credentials.
• Legacy data science and soil-moisture tools: company login credentials.
• salemans: CMI credentials.

These files are now mode 0600. Preserve their provenance under archive until the user decides whether each credential is still valid; stale credentials should be revoked instead of retained indefinitely.

Excluded from migration

• Tracked .env.example files and public URL-only frontend environments.
• Tracked Apache Superset/Hive development defaults.
• Empty placeholders, queue names, ports, bucket names, and service URLs.
• NixOS SOPS secrets and personal Vaultwarden entries, which already have their own authorities.

Observed services

The scan identified Yookr measurement, authentication, management, aggregation, rules, prediction, dashboard, and data-science workflows plus MySQL, MongoDB, RabbitMQ, Leafcloud S3, logger, SMTP, Vonage, TTN, WeatherAPI, CMI, Superset, and Hive integrations. Presence in an archive does not establish that a service or credential is still active.

Immediate findings

• The discovered dashboard S3 credential can list eight Leafcloud containers but cannot see irristaud; a credential from the irristaud project is required.
• The generated Yookr OpenAPI document remains malformed, but direct requests use the reviewed local contract and work independently.
• Management accepts an account-issued JWT only as the raw Authorization value, contrary to its current OpenAPI Bearer declaration.
• Herdr issue 197 is suitable for a local planning pilot, but the current Codex session is not running inside Herdr and must not control it.