README

06 — Secrets & Credentials

Single source of truth for how credentials are stored, accessed, rotated, and audited across the Ecotrans infrastructure.

SOPS+age is the vault for all p24-infra credentials. Infisical CE was fully decommissioned 2026-06-21. GitHub Secrets are used for CI/CD values that cannot be stored in SOPS files.

Key Documents

Document	Description
secrets-management.md	Policy, patterns, and rules for all credential types
infisical-ce-operations.md	Infisical CE — DECOMMISSIONED 2026-06-21 — historical reference only
secrets-sops-age.md	SOPS+age setup, key management, and encryption procedures
n8n-secrets-audit.md	Audit of all n8n credential references — no hardcoded keys
secrets-rotation-log.md	Chronological log of every credential rotation
password-rotation-procedures.md	Step-by-step rotation procedures per credential type
per-service-credential-isolation-plan.md	Plan (#2416): MongoDB per-service users + mongodb-admin worker role + one-secret-per-exposure-point migration
03-secrets-management.md	Secrets management improvement proposals

Secrets Map (SOPS+age)

SOPS file	Hosts covered	Local fallback
secrets/monitoring.env.sops	vps-i1 monitoring stack	/opt/p24-infra/monitoring/.env on vps-i1
secrets/n8n-bms4.env.sops	bms-4 n8n stack	/opt/p24-infra/bms-4/.env on bms-4
secrets/vps-h1.env.sops	Hostinger WAHA stack	/root/.env on vps-h1
secrets/bms-servers.env.sops	BMS root + MongoDB passwords	decrypt on demand
secrets/art-agency.env.sops	Art Agency credentials	Art-Agency/.env.local
secrets/brandpilot.env.sops	BrandPilot AI automation	brandpilot/.env.local
secrets/radekkonarski-brand.env.sops	Personal brand credentials	.env.local
GH Secrets	CI/CD-only values (SSH keys, AGE_KEY_GHA, etc.)	N/A

Rules (mandatory — no exceptions)

• Never display a credential value in chat or commit it to git
• Never ask the user to paste a secret value into chat
• Always read from SOPS (secrets/*.env.sops) or .env / .env.local; reference by variable name only
• Rotate the old value at source after the new value is live everywhere
• Append every rotation to secrets-rotation-log.md

Adding a New Secret

1. Add to the correct SOPS file (e.g. secrets/monitoring.env.sops) — see docs/secrets-management.md
2. Commit and push — secrets-sync.yml auto-deploys to servers on merge to dev or main
3. Or trigger manually: gh workflow run secrets-sync.yml --repo radieu/p24-infra
4. Restart only the affected container(s)
5. Update .env.local on developer workstation if needed

Cross-references

• README — SSH keys and OAuth (distinct from API secrets)
• README — you are here
• README — rotation log and session-based rotation actions