fkrebs/docs
1
0
Fork 0
Code Issues 14 Pull Requests Actions Packages Projects Releases Wiki Activity

Mark CT 112 live; add to portmap; update secrets-manager

Browse Source 
CT 112 "secrets" deployed 2026-05-22 — Infisical + Postgres 16 + Redis 7
running at http://192.168.1.7:8200 (LAN-only, no Zoraxy route).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Florian Krebs
2026-05-22 10:20:41 +02:00
parent 0e50996b43
commit b0160322b3
3 changed files with 25 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/secrets-manager.md
+9 -6
View File
@@ -1,4 +1,8 @@
# Secrets Manager — Design & Integration
# Secrets Manager — Infisical on CT 112
**Status: deployed 2026-05-22.** Running at `http://192.168.1.7:8200` (LAN-only, no Zoraxy route — secrets must not be internet-exposed).
Stack: `infisical/infisical:latest-postgres` + Postgres 16 + Redis 7, all on CT 112 (`secrets`, `192.168.1.7`). Compose at `/opt/stacks/infisical/` on CT 112.
## Problem statement
@@ -6,14 +10,13 @@ Secrets are currently scattered across:
| Location | Count | Risk |
|---|---|---|
| `/opt/stacks/ai/.env` on CT 104 | ~30 keys | Readable by any root-equivalent process; not versioned |
| `/opt/stacks/ai/.env` on CT 104 | ~55 keys | Not versioned; duplicated across stacks |
| Per-stack `.env` files CT 104 | ~30 keys | Several duplicated (WALG keys, IMMICH_API_KEY, etc.) |
| CT 101, 111, 113 `.env` files | ~30 keys | No central rotation story |
| Coder `main.tf` (hardcoded env vars) | 6 | Committed to Gitea; visible in template history |
| Zoraxy proxy configs | 0 (plain routes) | Low |
| HA `secrets.yaml` on HAOS VM 100 | unknown | Not backed up centrally |
| `/root/garage-chat-artifacts.creds` | 1 | `0600`, but on Proxmox host root |
| Browser/Vaultwarden (manual) | Many | Human-only access |
Goal: single secret store that agents, Docker services, and Coder workspaces can all read programmatically, with OIDC-gated access via Pocket-ID.
Goal: single LAN-only secret store that agents, Docker services, and Coder workspaces pull from programmatically. ~85 unique secrets identified in sweep (2026-05-22).
---