# Secrets

This repository is designed to be public. Do not commit real secret values.

## Secret Inventory

| Secret | Generated by | Stored where | Rotation note |
| --- | --- | --- | --- |
| PDS admin password | PDS installer | password manager and `/pds/pds.env` | rotate with PDS tooling if supported |
| PLC rotation/recovery keys | PDS installer / PLC tooling | password manager and `/pds` | critical account recovery material |
| R2 live blob access key | Cloudflare R2 | ignored VM env file and password manager | rotate by adding new key, updating PDS, then revoking old key |
| R2 live blob secret key | Cloudflare R2 | ignored VM env file and password manager | never print in logs |
| R2 backup access key | Cloudflare R2 | `/etc/pds-backup.env` and password manager | prefer separate key from live blob storage |
| R2 backup secret key | Cloudflare R2 | `/etc/pds-backup.env` and password manager | never print in logs |
| Cloudflare Origin CA private key | Cloudflare Origin CA | VM file under `/pds/certs` or equivalent and password manager | replace before certificate expiration |
| Cloudflare API token | Cloudflare | password manager only unless automation needs it | use least privilege |
| SSH private key | local machine | `~/.ssh/gcp` | never copy into this repo |
| account password / app passwords | user-created | password manager | rotate if exposed |

## Files That Must Stay Ignored

- `/pds/pds.env`
- `/etc/pds-backup.env`
- real `.env` files
- `*.key`
- `*.pem`
- backup archives
- SQLite databases
- generated config under `generated/` or `rendered/`

## Redaction Rules

Before sharing logs or command output, remove:

- access keys and secret keys
- bearer tokens
- passwords
- private keys
- DIDs only if you want operational privacy
- email addresses if not intended to be public

## Rotation Order

Rotate one class of secret at a time:

1. create the replacement secret
2. install it in the ignored production env or config file
3. restart only the affected service
4. run health checks
5. revoke the old secret
6. run one backup if the secret lives in `/pds`