Initial curated ITWorx_MCP_Hub source from 368fba691ea8d23403b4d56b53b5ec670d7c5020

infrastructure/secrets/README.md

@@ -0,0 +1,26 @@
+# Secret provisioning
+
+Create one file per secret under the deployed `${SECRETS_DIR}` with mode `0600` and an owner readable only by the intended deployment operator. Do not commit the directory or copy its contents into evidence.
+
+Required core secrets:
+
+- `postgres_superuser_password`
+- `hub_database_password`
+- `contextforge_database_password`
+- `contextforge_auth_encryption_secret`
+- `contextforge_jwt_secret`
+- `contextforge_admin_credential`
+- `contextforge_api_token` (generated by the controlled ContextForge bootstrap)
+- `stitch_api_key` (Google Stitch API key; connector-only, never exposed to MCP clients)
+- `authentik_oidc_client_secret`
+- `hub_session_signing_key`
+
+`contextforge_api_token` is absent during the initial predeploy check. Generate
+it with `scripts/contextforge_bootstrap.py` after ContextForge is healthy and
+scope it to the bootstrap's explicit gateway, tool, prompt and virtual-server
+permissions. Rotate an older token when the required permission set changes,
+then start the Hub services; the poststart preflight requires it.
+
+Optional connector secrets are added only when that connector is enabled. Use least-privilege, read-only credentials in v1.0.
+
+The application may show whether a secret reference is configured and when it was last verified. It must never show, return, audit, or log the value.