Mark CT 112 live; add to portmap; update secrets-manager

CT 112 "secrets" deployed 2026-05-22 — Infisical + Postgres 16 + Redis 7
running at http://192.168.1.7:8200 (LAN-only, no Zoraxy route).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

ct-inventory.md

@@ -14,11 +14,11 @@ Verified 2026-05-20 via `pct list`, `pct config <id>`, `qm config 100` on `nuc`.
 | 109 | observe | LXC | ⚠️ TBD (`.6`=CT 113, `.7`=CT 112) — likely `.8` | 4 | 8192 | 50 GiB | **Planned** — Prometheus, Loki, Grafana, Arcane Manager, Dozzle, Homarr, Diun, sshwifty, Tinyauth, socket-proxy; Alloy agents on all hosts | — | no | **planned** (see `infra/proxmox-state.md` §16) |
 | 110 | id | LXC unpriv | 192.168.1.5/24 | 1 | 1024 | 4 GiB | **Pocket-ID** OIDC IdP (`id.nuclide.systems`); migrated off CT 104 on 2026-05-20 | — | no | running |
 | 111 | dev | LXC unpriv | 192.168.1.42/24 | 12 | 32768 | 60 GiB | Dev host — **Coder + Gitea** + workspaces | mp0 NFS | Intel iGPU (render only; symlinked at `/dev/dri/renderD128`) | running |
-| 112 | secrets | LXC unpriv | 192.168.1.7/24 | 2 | 4096 | 20 GiB | **Planned** — Infisical secrets manager (own Postgres + Redis; replaces scattered .env files) | — | no | **planned** |
+| 112 | secrets | LXC unpriv | 192.168.1.7/24 | 2 | 4096 | 20 GiB | **Infisical** secrets manager (own Postgres 16 + Redis 7; replaces scattered .env files) — LAN-only, no Zoraxy route | — | no | running |
 
 UNAS NFS = `192.168.1.31:/var/nfs/shared/storage` over NFSv3. CT 105 (Nextcloud) is the lone outlier — it mounts the same UNAS share over **CIFS/SMB 3.1.1**, not NFS.
 
-CT 112 ("secrets") — Infisical deployment planned; see `services/secrets-manager.md`.
+CT 112 ("secrets") — Infisical deployed 2026-05-22; see `services/secrets-manager.md`. LAN: `http://192.168.1.7:8200`. No Zoraxy route — secrets must not be internet-exposed.
 
 ## SSH access
 

infra/portmap.md

@@ -140,6 +140,20 @@ _Traccar moved to 15000–15001 (Documents range). 19000–19001 now free._
 
 ---
 
+## LXC 112 — secrets (`192.168.1.7`)
+
+CT 112 hosts Infisical. **LAN-only — no Zoraxy route; secrets must not be internet-exposed.**
+
+| Port | Service | Container | Notes |
+|---|---|---|---|
+| 8200 | Infisical | `infisical` | LAN: `http://192.168.1.7:8200` — admin UI + API |
+| (internal) | Postgres 16 | `infisical-db` | DB for Infisical only; no external port |
+| (internal) | Redis 7 | `infisical-redis` | Session/queue backing; no external port |
+
+Stack at `/opt/stacks/infisical/` on CT 112. Deployed 2026-05-22.
+
+---
+
 ## LXC 113 — db (`192.168.1.6`)
 
 CT 113 is the dedicated postgres LXC. No public proxy routes — LAN access only.

services/secrets-manager.md

@@ -1,4 +1,8 @@
-# Secrets Manager — Design & Integration
+# Secrets Manager — Infisical on CT 112
+
+**Status: deployed 2026-05-22.** Running at `http://192.168.1.7:8200` (LAN-only, no Zoraxy route — secrets must not be internet-exposed).
+
+Stack: `infisical/infisical:latest-postgres` + Postgres 16 + Redis 7, all on CT 112 (`secrets`, `192.168.1.7`). Compose at `/opt/stacks/infisical/` on CT 112.
 
 ## Problem statement
 
@@ -6,14 +10,13 @@ Secrets are currently scattered across:
 
 | Location | Count | Risk |
 |---|---|---|
-| `/opt/stacks/ai/.env` on CT 104 | ~30 keys | Readable by any root-equivalent process; not versioned |
+| `/opt/stacks/ai/.env` on CT 104 | ~55 keys | Not versioned; duplicated across stacks |
+| Per-stack `.env` files CT 104 | ~30 keys | Several duplicated (WALG keys, IMMICH_API_KEY, etc.) |
+| CT 101, 111, 113 `.env` files | ~30 keys | No central rotation story |
 | Coder `main.tf` (hardcoded env vars) | 6 | Committed to Gitea; visible in template history |
-| Zoraxy proxy configs | 0 (plain routes) | Low |
 | HA `secrets.yaml` on HAOS VM 100 | unknown | Not backed up centrally |
-| `/root/garage-chat-artifacts.creds` | 1 | `0600`, but on Proxmox host root |
-| Browser/Vaultwarden (manual) | Many | Human-only access |
 
-Goal: single secret store that agents, Docker services, and Coder workspaces can all read programmatically, with OIDC-gated access via Pocket-ID.
+Goal: single LAN-only secret store that agents, Docker services, and Coder workspaces pull from programmatically. ~85 unique secrets identified in sweep (2026-05-22).
 
 ---