Secrets #

This repository is designed to be public. Do not commit real secret values.

Secret Inventory #

Secret	Generated by	Stored where	Rotation note
PDS admin password	PDS installer	password manager and /pds/pds.env	rotate with PDS tooling if supported
PLC rotation/recovery keys	PDS installer / PLC tooling	password manager and /pds	critical account recovery material
R2 live blob access key	Cloudflare R2	ignored VM env file and password manager	rotate by adding new key, updating PDS, then revoking old key
R2 live blob secret key	Cloudflare R2	ignored VM env file and password manager	never print in logs
R2 backup access key	Cloudflare R2	/etc/pds-backup.env and password manager	prefer separate key from live blob storage
R2 backup secret key	Cloudflare R2	/etc/pds-backup.env and password manager	never print in logs
Cloudflare Origin CA private key	Cloudflare Origin CA	VM file under /pds/certs or equivalent and password manager	replace before certificate expiration
Cloudflare API token	Cloudflare	password manager only unless automation needs it	use least privilege
SSH private key	local machine	~/.ssh/gcp	never copy into this repo
account password / app passwords	user-created	password manager	rotate if exposed

Files That Must Stay Ignored #

• /pds/pds.env
• /etc/pds-backup.env
• real .env files
• *.key
• *.pem
• backup archives
• SQLite databases
• generated config under generated/ or rendered/

Redaction Rules #

Before sharing logs or command output, remove:

• access keys and secret keys
• bearer tokens
• passwords
• private keys
• DIDs only if you want operational privacy
• email addresses if not intended to be public

Rotation Order #

Rotate one class of secret at a time:

1. create the replacement secret
2. install it in the ignored production env or config file
3. restart only the affected service
4. run health checks
5. revoke the old secret
6. run one backup if the secret lives in /pds