From bf02e29fd612b353827180ea5d35f25f28ff31d0 Mon Sep 17 00:00:00 2001 From: Timothy Kim Date: Tue, 7 Apr 2026 16:47:12 -0400 Subject: [PATCH] Document secrets moved to .env files with Bitwarden fallback Secrets were removed from the repo and moved to .env files on the server. Added runbook step for restoring them from USB backup (or recreating from Bitwarden), updated the protection table in README, and added architecture note in CLAUDE.md. --- CLAUDE.md | 1 + README.md | 1 + RUNBOOK.md | 26 ++++++++++++++++++++------ 3 files changed, 22 insertions(+), 6 deletions(-) diff --git a/CLAUDE.md b/CLAUDE.md index f13241f..2ef4ad9 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -16,6 +16,7 @@ Recovery steps are in `RUNBOOK.md`. Repo overview and workflows are in `README.m - **Minecraft HTTP-only**: HTTPS causes WebSocket/CORS errors with the MCSManager daemon. No cert issued for this domain. - **SSL cert issuance chicken-and-egg**: On fresh recovery, certs don't exist so SSL confs can't load. The `.hold` pattern moves SSL confs aside, starts nginx with HTTP-only confs, issues certs, then restores SSL confs. - **SELinux is enforcing**: Caused issues with samba (symlinks blocked, parent directory traversal blocked). Don't use symlinks for config files — use the sync-system.sh copy approach instead. +- **Secrets in .env files**: All secrets (DB passwords, API keys, tokens) live in `.env` files under each app's `docker//` directory on the server. These are gitignored (`**/.env` in root `.gitignore`). The `.env` files are included in the USB backup. If the backup is lost, all secrets can be recreated from Bitwarden. The `system/msmtprc` in the repo has its password REDACTED -- the real one is only on the server. - **ZFS parent dataset mountpoints**: Pools have parent datasets (e.g., `nextcloud`, `threeteras`) that create mountpoints like `/mnt/nextcloud`. These are empty and expected — do not delete them. - **msmtp**: Replaces sendmail for cron MAILTO and smartd email alerts. Configured via `/etc/msmtprc` (Fastmail SMTP). The symlink `/usr/sbin/sendmail -> /usr/bin/msmtp` is set up in recovery step 2. - **hantim-server**: Sister repo with similar nginx/certbot patterns. Located at `~/dev/hantim-server`. Useful as reference for deploy patterns. diff --git a/README.md b/README.md index 124b618..eed72d7 100644 --- a/README.md +++ b/README.md @@ -85,4 +85,5 @@ See [RUNBOOK.md](RUNBOOK.md) for full disaster recovery steps. | Nextcloud DB (PostgreSQL) | ZFS dataset + `pg_dumpall` + USB | `rsync` from USB | | Garage S3 data | 2-node replication + USB | Replication or USB | | Gitea repos + DB | SQLite `.backup` + USB | `rsync` from USB | +| Secrets (.env files) | USB backup + Bitwarden | `rsync` from USB, or recreate from Bitwarden | | SSL certificates | Re-issued from Let's Encrypt | `./scripts/issue-cert.sh` | diff --git a/RUNBOOK.md b/RUNBOOK.md index 054cc5b..f5b5112 100644 --- a/RUNBOOK.md +++ b/RUNBOOK.md @@ -124,7 +124,21 @@ zpool status # verify pools are ONLINE rsync -a /mnt/backup/argento/ /opt/argento/ ``` -## 8. System configs +## 8. Restore .env files + +Secrets are not in the repo -- they live in `.env` files on the server. Restore from USB backup: + +```bash +# .env files are backed up alongside app data +# After the rsync in step 7, they should already be in place. Verify: +ls /opt/argento/docker/*/.env + +# If USB backup is unavailable (full from-scratch rebuild), +# recreate .env files manually from Bitwarden. +# Each app's compose.yaml or runner-config.yaml references its .env file. +``` + +## 9. System configs ```bash cp /opt/argento/system/docker-daemon.json /etc/docker/daemon.json @@ -137,7 +151,7 @@ systemctl restart docker smb smartd crontab /opt/argento/system/root-crontab ``` -## 9. Nginx + SSL +## 10. Nginx + SSL ```bash # Create shared network @@ -177,7 +191,7 @@ systemctl enable --now certbot-renew.timer certbot renew --dry-run ``` -## 10. Docker apps +## 11. Docker apps Deploy each app (nginx is already running and will return 502 until they start): @@ -193,7 +207,7 @@ done docker ps # verify all containers are healthy ``` -## 11. Router +## 12. Router Set up port forwarding on the home router: @@ -203,7 +217,7 @@ Set up port forwarding on the home router: - 3901 -> 192.168.2.122:3901 (Garage RPC) - 25500-25600 -> 192.168.2.122:25500-25600 (Minecraft) -## 12. DNS +## 13. DNS CNAME records pointing to the DDNS hostname. These don't need updating when the IP changes -- only the DDNS record does. @@ -216,7 +230,7 @@ CNAME records pointing to the DDNS hostname. These don't need updating when the | `garage.timothykim.net` | CNAME | `argento.ddns.net` | | `minecraft.thekims.family` | CNAME | `argento.ddns.net` | -## 13. Verify +## 14. Verify ```bash curl -I https://nextcloud.timothykim.net