ITWorx_MCP_Hub-Public/infrastructure/secrets/README.md

Secret provisioning

Create one file per secret under the deployed ${SECRETS_DIR} with mode 0600 and an owner readable only by the intended deployment operator. Do not commit the directory or copy its contents into evidence.

Required core secrets:

• postgres_superuser_password
• hub_database_password
• contextforge_database_password
• contextforge_auth_encryption_secret
• contextforge_jwt_secret
• contextforge_admin_credential
• contextforge_api_token (generated by the controlled ContextForge bootstrap)
• stitch_api_key (Google Stitch API key; connector-only, never exposed to MCP clients)
• authentik_oidc_client_secret
• hub_session_signing_key

contextforge_api_token is absent during the initial predeploy check. Generate it with scripts/contextforge_bootstrap.py after ContextForge is healthy and scope it to the bootstrap's explicit gateway, tool, prompt and virtual-server permissions. Rotate an older token when the required permission set changes, then start the Hub services; the poststart preflight requires it.

Optional connector secrets are added only when that connector is enabled. Use least-privilege, read-only credentials in v1.0.

The application may show whether a secret reference is configured and when it was last verified. It must never show, return, audit, or log the value.