Micha/homelab-infra
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

Healthchecks: mark live after API deploy; document host secret files

Browse Source 
Stack deployed to Komodo (id 6a3acf2ca7867a4fbab9bfc1), both containers
healthy, Traefik route + LE cert OK, DNS resolves, superuser created and
auth-verified. Flip status to live in ARCHITECTURE 7.6, SERVICE_CATALOG,
MASTER_TODO and the stack README. Document the new host secret files
(secret_key, superuser_password = login password, webhook_secret) in
SECRETS_MAP. Remaining operator step: the Gitea->Komodo webhook.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Micha
2026-06-23 20:31:10 +02:00
parent cbfbb8ca4f
commit 02389ed292
5 changed files with 20 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/SECRETS_MAP.md
+15 -4
View File
@@ -40,6 +40,8 @@ Dieses Dokument listet sensible Daten, deren Ablageorte und die vorgesehene Einb
| Authelia | Postgres Password | `/mnt/user/appdata/secrets/authelia_postgres_password.txt` -> `AUTHELIA_STORAGE_POSTGRES_PASSWORD_FILE` | aktiv |
| Komodo Mongo | Root Password | `/mnt/user/appdata/secrets/komodo_mongo_password.txt` -> `MONGO_INITDB_ROOT_PASSWORD_FILE` | aktiv |
| Komodo Core | App Secrets | Stack ENV `${KOMODO_SECRET_KEY}`, `${KOMODO_WEBHOOK_SECRET}`, `${KOMODO_JWT_SECRET}`, `${KOMODO_MONGO_PASSWORD}`, `${KOMODO_PERIPHERY_PASSKEY}` | aktiv |
| Codex/Claude -> Komodo API | CLI/API Credentials | `/mnt/user/appdata/secrets/codex_komodo_api.env` (root:root, 0600) -> Host-only Shell-Env fuer Komodo-CLI-Zugriff; Werte nie ausgeben, loggen oder committen | aktiv; nur auf ausdrueckliche Operator-Anweisung nutzen |
| Codex/Claude -> Unraid API | API Key | `/mnt/user/appdata/secrets/codex_unraid_api_key.txt` (root:root, 0600) -> Host-only API-Zugriff; Wert nie ausgeben, loggen oder committen | aktiv; nur auf ausdrueckliche Operator-Anweisung nutzen |
| Gitea Push Mirror | GitHub fine-grained PAT fuer `michaelkaleschke-spec/homelab-infra` | Gitea Repository Mirror Settings, persistent in `/mnt/user/services/gitea/data`; kein Datei-Secret im Repo | aktiv |
| Glance | Community Widget API Tokens | Stack ENV `${GLANCE_IMMICH_API_KEY}`, `${GLANCE_ADGUARD_USERNAME}`, `${GLANCE_ADGUARD_PASSWORD}`, `${GLANCE_SPEEDTEST_API_KEY}`, `${GLANCE_KOMODO_API_KEY}`, `${GLANCE_KOMODO_API_SECRET}`, `${GLANCE_GITEA_TOKEN}`, `${GLANCE_PAPERLESS_TOKEN}`, `${GLANCE_MEALIE_TOKEN}` (alle read-only anlegen), `${GLANCE_HA_TOKEN}` (HA Long-Lived Access Token; Glance nutzt nur `GET /api/states`) | aktiv |
| speedtest-tracker | App Key / Admin-Zugang | Stack ENV `${APP_KEY}`, `${ADMIN_PASSWORD}` | aktiv |
@@ -50,10 +52,11 @@ Dieses Dokument listet sensible Daten, deren Ablageorte und die vorgesehene Einb
| Borg Repo | Borg-Passphrase fuer Restore-Tests und Notfallzugriff | `/mnt/user/appdata/secrets/borg_repo_passphrase.txt` -> Host-Secret-Datei, nicht im Repo | aktiv |
| Healthchecks Dead-Man's-Switch (Borg Pre-Hook) | Ping-/Capability-URL | `/mnt/user/appdata/secrets/healthchecks_borg_url` (chmod 600) **oder** ENV `HEALTHCHECKS_BORG_URL`/`HEALTHCHECKS_URL`, gelesen von `ops/borg-ui/scripts/pre-borg.sh`; URL ist eine Capability-URL -> wie Secret behandeln, nie ins Repo | aktiv nach Operator-Setup |
| Healthchecks Dead-Man's-Switch (Nearline-Pull) | Ping-/Capability-URL | baerchen: ENV `HEALTHCHECKS_NEARLINE_URL` **oder** `%USERPROFILE%\.kallilab\healthchecks-nearline-url.txt`, gelesen von `ops/h-drive-nearline/pull-critical-backups.ps1`; URL ist eine Capability-URL -> wie Secret behandeln, nie ins Repo | aktiv nach Operator-Setup |
| Healthchecks self-hosted (`ops/healthchecks/`) | Django `SECRET_KEY` | Komodo Stack-ENV `${HEALTHCHECKS_SECRET_KEY}` (Image hat keinen `_FILE`-Support) | vorbereitet |
| Healthchecks self-hosted | DB Password | Komodo Stack-ENV `${HEALTHCHECKS_DB_PASSWORD}` (= Wert von `healthchecks_postgres_password.txt`) | vorbereitet |
| Healthchecks self-hosted | Superuser Login | Komodo Stack-ENV `${HEALTHCHECKS_SUPERUSER_EMAIL}`, `${HEALTHCHECKS_SUPERUSER_PASSWORD}` | vorbereitet |
| healthchecks-postgres | DB Password | `/mnt/user/appdata/secrets/healthchecks_postgres_password.txt` -> `POSTGRES_PASSWORD_FILE` | vorbereitet |
| Healthchecks self-hosted (`ops/healthchecks/`) | Django `SECRET_KEY` | Komodo Stack-ENV `${HEALTHCHECKS_SECRET_KEY}` (Image hat keinen `_FILE`-Support); Host-Backup `/mnt/user/appdata/secrets/healthchecks_secret_key.txt` | aktiv (2026-06-23) |
| Healthchecks self-hosted | DB Password | Komodo Stack-ENV `${HEALTHCHECKS_DB_PASSWORD}` (= Wert von `healthchecks_postgres_password.txt`) | aktiv (2026-06-23) |
| Healthchecks self-hosted | Superuser Login | Komodo Stack-ENV `${HEALTHCHECKS_SUPERUSER_EMAIL}` (Login-Mail) + `${HEALTHCHECKS_SUPERUSER_PASSWORD}`; **Login-Passwort als Host-Datei** `/mnt/user/appdata/secrets/healthchecks_superuser_password.txt` (nach erstem Login aenderbar) | aktiv (2026-06-23) |
| Healthchecks self-hosted | Gitea->Komodo Webhook Secret | `/mnt/user/appdata/secrets/healthchecks_webhook_secret.txt` (chmod 600) = per-Stack `webhook_secret` in Komodo; im Gitea-Hook identisch eintragen | aktiv (2026-06-23) |
| healthchecks-postgres | DB Password | `/mnt/user/appdata/secrets/healthchecks_postgres_password.txt` -> `POSTGRES_PASSWORD_FILE` | aktiv (2026-06-23) |
| Unraid Flash Backup | Boot-/Array-/Share-/Plugin-Konfiguration, ggf. Hashes/Keys/Templates | `/mnt/user/backups/borg/dumps/latest/unraid-flash-config.tar.gz`, via Borg/Hetzner gesichert | aktiv; wie Secret-Material behandeln |
| Hermes Agent | Provider-Keys, Bot-Tokens, API-Server-Key | `/mnt/user/appdata/hermes-agent/data/.env` | VM-seitig offen |
| Hermes Agent | SSH-Runner Private Key | `/mnt/user/appdata/secrets/hermes_runner_id_ed25519` -> `/root/.ssh/id_ed25519` | VM-seitig offen |
@@ -70,6 +73,7 @@ Dieses Dokument listet sensible Daten, deren Ablageorte und die vorgesehene Einb
| Dawarich Metrics | Basic-Auth Password | `/mnt/user/appdata/secrets/dawarich_metrics_password.txt` -> Docker Secret `/run/secrets/dawarich_metrics_password`; Prometheus `password_file` | aktiv |
| Grafana -> Dawarich | Read-only DB Password | `/mnt/user/appdata/secrets/dawarich_grafana_ro_password.txt` -> Docker Secret `/run/secrets/dawarich_grafana_ro_password`; Grafana-Env `DAWARICH_GRAFANA_RO_PASSWORD` | aktiv |
| Renovate Bot | Gitea Service-Account PAT | `/mnt/user/appdata/secrets/renovate_token.txt` -> Host-Datei (chmod 600), gelesen von `ops/renovate/run-renovate.sh` und an Renovate-Container als `RENOVATE_TOKEN` weitergegeben | aktiv nach Operator-Setup (siehe `docs/RENOVATE.md`) |
| Renovate Bot | GitHub.com Read-only PAT fuer Release Notes | `/mnt/user/appdata/secrets/renovate_github_com_token.txt` -> Host-Datei (chmod 600), optional gelesen von `ops/renovate/run-renovate.sh` und an Renovate-Container als `RENOVATE_GITHUB_COM_TOKEN` weitergegeben | optional; behebt Dependency-Dashboard-Warnung zu fehlendem github.com-Token |
| n8n | Encryption Key fuer interne Credential-Verschluesselung | `/mnt/user/appdata/secrets/n8n_encryption_key.txt` (chmod 600) -> Komodo Stack ENV `${N8N_ENCRYPTION_KEY}`; kein `_FILE`-Support im Upstream-Image | aktiv |
| n8n | GMX IMAP Login (Mail-Trigger Workflow) | n8n Credentials Store (Typ `imap`), nur in `/mnt/user/appdata/n8n/data` mit `N8N_ENCRYPTION_KEY` verschluesselt | aktiv |
| n8n | OpenAI API Key (LLM-Extraktion Workflow) | n8n Credentials Store (Typ `httpHeaderAuth`, Header `Authorization: Bearer ...`) | aktiv |
@@ -101,6 +105,8 @@ Dieses Dokument listet sensible Daten, deren Ablageorte und die vorgesehene Einb
|-- authelia_smtp_password.txt
|-- authelia_storage_encryption_key.txt
|-- immich_postgres_password.txt
|-- codex_komodo_api.env
|-- codex_unraid_api_key.txt
|-- komodo_mongo_password.txt
|-- mealie_postgres_password.txt
|-- monitoring_grafana_admin_password.txt
@@ -110,6 +116,8 @@ Dieses Dokument listet sensible Daten, deren Ablageorte und die vorgesehene Einb
|-- nextcloud_postgres_password.txt
|-- postgres_password.txt
|-- redis_password.txt
|-- renovate_github_com_token.txt
|-- renovate_token.txt
|-- borg_repo_passphrase.txt
|-- influxdb3_admin_token.json
|-- ha_influxdb_token
@@ -123,6 +131,9 @@ Dieses Dokument listet sensible Daten, deren Ablageorte und die vorgesehene Einb
|-- dawarich_metrics_password.txt
|-- dawarich_grafana_ro_password.txt
|-- healthchecks_postgres_password.txt
|-- healthchecks_secret_key.txt
|-- healthchecks_superuser_password.txt
|-- healthchecks_webhook_secret.txt
`-- vaultwarden_admin_token.txt
```