timothykim/argento
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Document secrets moved to .env files with Bitwarden fallback

Browse Source 
Secrets were removed from the repo and moved to .env files on the
server. Added runbook step for restoring them from USB backup (or
recreating from Bitwarden), updated the protection table in README,
and added architecture note in CLAUDE.md.
This commit is contained in:
Timothy Kim
2026-04-07 16:47:12 -04:00
parent bc1b1d1232
commit bf02e29fd6
3 changed files with 22 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
RUNBOOK.md
+20 -6
View File
@@ -124,7 +124,21 @@ zpool status # verify pools are ONLINE
rsync -a /mnt/backup/argento/ /opt/argento/
```
## 8. System configs
## 8. Restore .env files
Secrets are not in the repo -- they live in `.env` files on the server. Restore from USB backup:
```bash
# .env files are backed up alongside app data
# After the rsync in step 7, they should already be in place. Verify:
ls /opt/argento/docker/*/.env
# If USB backup is unavailable (full from-scratch rebuild),
# recreate .env files manually from Bitwarden.
# Each app's compose.yaml or runner-config.yaml references its .env file.
```
## 9. System configs
```bash
cp /opt/argento/system/docker-daemon.json /etc/docker/daemon.json
@@ -137,7 +151,7 @@ systemctl restart docker smb smartd
crontab /opt/argento/system/root-crontab
```
## 9. Nginx + SSL
## 10. Nginx + SSL
```bash
# Create shared network
@@ -177,7 +191,7 @@ systemctl enable --now certbot-renew.timer
certbot renew --dry-run
```
## 10. Docker apps
## 11. Docker apps
Deploy each app (nginx is already running and will return 502 until they start):
@@ -193,7 +207,7 @@ done
docker ps # verify all containers are healthy
```
## 11. Router
## 12. Router
Set up port forwarding on the home router:
@@ -203,7 +217,7 @@ Set up port forwarding on the home router:
- 3901 -> 192.168.2.122:3901 (Garage RPC)
- 25500-25600 -> 192.168.2.122:25500-25600 (Minecraft)
## 12. DNS
## 13. DNS
CNAME records pointing to the DDNS hostname. These don't need updating when the IP changes -- only the DDNS record does.
@@ -216,7 +230,7 @@ CNAME records pointing to the DDNS hostname. These don't need updating when the
| `garage.timothykim.net` | CNAME | `argento.ddns.net` |
| `minecraft.thekims.family` | CNAME | `argento.ddns.net` |
## 13. Verify
## 14. Verify
```bash
curl -I https://nextcloud.timothykim.net