p24-infra Docs

secret-repo-access-matrix

3 min read

Secret Repo Access Matrix

Who can request what. Read by the secret-manager worker before any cross-repo secret operation.

Last reviewed: 2026-07-01 Reviewer: Radek Konarski (auto-populated from SOPS key names, 2026-07-01)

Format

Each repo entry lists:

  • May request ROTATE for — secrets this repo owns and can trigger autonomous rotation on
  • May request CREATE for — usually empty; new secrets always require a p24-infra session
  • May NOT request — explicit blocklist for high blast-radius or shared secrets

Validation rules (secret-manager worker must enforce):

  1. requesting_repo must match a repo listed below
  2. The secret_key must appear in the repo’s “May request ROTATE for” table
  3. The sops_file must match the registered value for that key
  4. read operation type is NEVER permitted via automated trigger

Repo: radieu/et-operational-platform

SOPS file: secrets/et-operational-platform.env.sops

May request ROTATE for:

Secret keySOPS fileNotes
CRON_SECRETet-operational-platform
GPS_EVENT_WEBHOOK_URLet-operational-platform
GPS_EVENT_WEBHOOK_ALLOWED_HOSTSet-operational-platform
N8N_ATRAX_REPORT_WEBHOOK_URLet-operational-platform
N8N_HU_SP_REPORT_WEBHOOK_URLet-operational-platform
OPENAI_API_KEYet-operational-platform
PINBOX24_WASABI_ACCESS_KEYet-operational-platformWasabi per-app key
PINBOX24_WASABI_SECRET_KEYet-operational-platformWasabi per-app key
ANTHROPIC_API_KEYet-operational-platform
DOCUMENT_INGEST_SECRETet-operational-platform
INSPECTION_WEBHOOK_SECRETet-operational-platform

May request CREATE for:

(empty — new secrets require a p24-infra session)

May NOT request:

  • SUPABASE_SERVICE_ROLE_KEY — shared platform key, blast radius = all Supabase operations
  • N8N_GPS_SYNC_SECRET — shared with n8n-bms4.env.sops; rotation must update both SOPS files
  • All admin keys (WASABI_ADMIN_*, CF_GLOBAL_API_KEY, SUPABASE_ACCESS_TOKEN)
  • mongodb_rs0_admin_password — blast radius: entire Pinbox24 production stack

Repo: radieu/Art-Agency

SOPS file: secrets/art-agency.env.sops

May request ROTATE for:

Secret keySOPS fileNotes
supabase_Art_Agency_passwordart-agency
clickup_clickup_api_keyart-agency
GOOGLE_ADS_DEVELOPER_TOKENart-agency
GOOGLE_ADS_CLIENT_SECRETart-agency
GOOGLE_ADS_REFRESH_TOKENart-agency
wasabi_art_agency_access_keyart-agencyWasabi per-app key
wasabi_art_agency_secret_keyart-agencyWasabi per-app key

May request CREATE for:

(empty)

May NOT request:

  • All admin keys
  • Any key in monitoring.env.sops, bms-servers.env.sops, or administration.env.sops

Repo: radieu/brandpilot

SOPS file: secrets/brandpilot.env.sops

May request ROTATE for:

Secret keySOPS fileNotes
RESEND_API_KEYbrandpilot
P24_INFRA_TELEGRAM_BOT_TOKENbrandpilot
P24_EMAIL_SENDER_CFbrandpilot
LINKEDIN_CLIENT_IDbrandpilot
LINKEDIN_CLIENT_SECRETbrandpilot

May request CREATE for:

(empty)

May NOT request:

  • All admin keys
  • Wasabi admin IAM keys

Repo: radieu/radekkonarski-personal-brand

SOPS file: secrets/radekkonarski-brand.env.sops (in that repo, not p24-infra — uses its own age key)

Note: Key names not populated here — the brand repo uses a separate age key not available to p24-infra sessions. Access the brand repo session directly to list keys via: sops -d secrets/radekkonarski-brand.env.sops | grep -o '^[A-Z_a-z]*'

May request ROTATE for:

Secret keySOPS fileNotes
Populate from brand repo sessionradekkonarski-brand

May request CREATE for:

(empty)

May NOT request:

  • Cross-app secrets (any key used by another repo)

Rejection policy

If any validation fails, the secret-manager worker:

  1. Posts a rejection comment on the requesting repo’s issue
  2. Closes the p24-infra infra-task-request issue with label access-denied
  3. Does NOT proceed with any SOPS operation

Rejection reasons:

  • repo_not_found — requesting repo not in this matrix
  • key_not_authorized — the requested key is not in the repo’s ROTATE allowlist
  • sops_file_mismatch — the sops_file in the request does not match the registered file
  • operation_not_permitted — read or create without P0 priority + human confirmation

References

  • Plan: docs/plans/plan-2427-rotate-secret-system.md §10
  • Secret-manager playbook: docs/playbooks/secret-manager.md
  • Rotation tier matrix: docs/playbooks/secret-rotation-access-matrix.md

Graph View

Backlinks