27 lines
1.3 KiB
Markdown
27 lines
1.3 KiB
Markdown
# Secret provisioning
|
|
|
|
Create one file per secret under the deployed `${SECRETS_DIR}` with mode `0600` and an owner readable only by the intended deployment operator. Do not commit the directory or copy its contents into evidence.
|
|
|
|
Required core secrets:
|
|
|
|
- `postgres_superuser_password`
|
|
- `hub_database_password`
|
|
- `contextforge_database_password`
|
|
- `contextforge_auth_encryption_secret`
|
|
- `contextforge_jwt_secret`
|
|
- `contextforge_admin_credential`
|
|
- `contextforge_api_token` (generated by the controlled ContextForge bootstrap)
|
|
- `stitch_api_key` (Google Stitch API key; connector-only, never exposed to MCP clients)
|
|
- `authentik_oidc_client_secret`
|
|
- `hub_session_signing_key`
|
|
|
|
`contextforge_api_token` is absent during the initial predeploy check. Generate
|
|
it with `scripts/contextforge_bootstrap.py` after ContextForge is healthy and
|
|
scope it to the bootstrap's explicit gateway, tool, prompt and virtual-server
|
|
permissions. Rotate an older token when the required permission set changes,
|
|
then start the Hub services; the poststart preflight requires it.
|
|
|
|
Optional connector secrets are added only when that connector is enabled. Use least-privilege, read-only credentials in v1.0.
|
|
|
|
The application may show whether a secret reference is configured and when it was last verified. It must never show, return, audit, or log the value.
|