diff --git a/ct-inventory.md b/ct-inventory.md index 8c93a3b..35e3285 100644 --- a/ct-inventory.md +++ b/ct-inventory.md @@ -14,11 +14,11 @@ Verified 2026-05-20 via `pct list`, `pct config `, `qm config 100` on `nuc`. | 109 | observe | LXC | ⚠️ TBD (`.6`=CT 113, `.7`=CT 112) — likely `.8` | 4 | 8192 | 50 GiB | **Planned** — Prometheus, Loki, Grafana, Arcane Manager, Dozzle, Homarr, Diun, sshwifty, Tinyauth, socket-proxy; Alloy agents on all hosts | — | no | **planned** (see `infra/proxmox-state.md` §16) | | 110 | id | LXC unpriv | 192.168.1.5/24 | 1 | 1024 | 4 GiB | **Pocket-ID** OIDC IdP (`id.nuclide.systems`); migrated off CT 104 on 2026-05-20 | — | no | running | | 111 | dev | LXC unpriv | 192.168.1.42/24 | 12 | 32768 | 60 GiB | Dev host — **Coder + Gitea** + workspaces | mp0 NFS | Intel iGPU (render only; symlinked at `/dev/dri/renderD128`) | running | -| 112 | secrets | LXC unpriv | 192.168.1.7/24 | 2 | 4096 | 20 GiB | **Planned** — Infisical secrets manager (own Postgres + Redis; replaces scattered .env files) | — | no | **planned** | +| 112 | secrets | LXC unpriv | 192.168.1.7/24 | 2 | 4096 | 20 GiB | **Infisical** secrets manager (own Postgres 16 + Redis 7; replaces scattered .env files) — LAN-only, no Zoraxy route | — | no | running | UNAS NFS = `192.168.1.31:/var/nfs/shared/storage` over NFSv3. CT 105 (Nextcloud) is the lone outlier — it mounts the same UNAS share over **CIFS/SMB 3.1.1**, not NFS. -CT 112 ("secrets") — Infisical deployment planned; see `services/secrets-manager.md`. +CT 112 ("secrets") — Infisical deployed 2026-05-22; see `services/secrets-manager.md`. LAN: `http://192.168.1.7:8200`. No Zoraxy route — secrets must not be internet-exposed. ## SSH access diff --git a/infra/portmap.md b/infra/portmap.md index c8ebf82..ef52aba 100644 --- a/infra/portmap.md +++ b/infra/portmap.md @@ -140,6 +140,20 @@ _Traccar moved to 15000–15001 (Documents range). 19000–19001 now free._ --- +## LXC 112 — secrets (`192.168.1.7`) + +CT 112 hosts Infisical. **LAN-only — no Zoraxy route; secrets must not be internet-exposed.** + +| Port | Service | Container | Notes | +|---|---|---|---| +| 8200 | Infisical | `infisical` | LAN: `http://192.168.1.7:8200` — admin UI + API | +| (internal) | Postgres 16 | `infisical-db` | DB for Infisical only; no external port | +| (internal) | Redis 7 | `infisical-redis` | Session/queue backing; no external port | + +Stack at `/opt/stacks/infisical/` on CT 112. Deployed 2026-05-22. + +--- + ## LXC 113 — db (`192.168.1.6`) CT 113 is the dedicated postgres LXC. No public proxy routes — LAN access only. diff --git a/services/secrets-manager.md b/services/secrets-manager.md index 7c2131e..08f9911 100644 --- a/services/secrets-manager.md +++ b/services/secrets-manager.md @@ -1,4 +1,8 @@ -# Secrets Manager — Design & Integration +# Secrets Manager — Infisical on CT 112 + +**Status: deployed 2026-05-22.** Running at `http://192.168.1.7:8200` (LAN-only, no Zoraxy route — secrets must not be internet-exposed). + +Stack: `infisical/infisical:latest-postgres` + Postgres 16 + Redis 7, all on CT 112 (`secrets`, `192.168.1.7`). Compose at `/opt/stacks/infisical/` on CT 112. ## Problem statement @@ -6,14 +10,13 @@ Secrets are currently scattered across: | Location | Count | Risk | |---|---|---| -| `/opt/stacks/ai/.env` on CT 104 | ~30 keys | Readable by any root-equivalent process; not versioned | +| `/opt/stacks/ai/.env` on CT 104 | ~55 keys | Not versioned; duplicated across stacks | +| Per-stack `.env` files CT 104 | ~30 keys | Several duplicated (WALG keys, IMMICH_API_KEY, etc.) | +| CT 101, 111, 113 `.env` files | ~30 keys | No central rotation story | | Coder `main.tf` (hardcoded env vars) | 6 | Committed to Gitea; visible in template history | -| Zoraxy proxy configs | 0 (plain routes) | Low | | HA `secrets.yaml` on HAOS VM 100 | unknown | Not backed up centrally | -| `/root/garage-chat-artifacts.creds` | 1 | `0600`, but on Proxmox host root | -| Browser/Vaultwarden (manual) | Many | Human-only access | -Goal: single secret store that agents, Docker services, and Coder workspaces can all read programmatically, with OIDC-gated access via Pocket-ID. +Goal: single LAN-only secret store that agents, Docker services, and Coder workspaces pull from programmatically. ~85 unique secrets identified in sweep (2026-05-22). ---