ERP/docs/SECRET-MANAGEMENT.md

Secret management & rotation

Policy (short): real credentials live only in git-ignored .env files — the server-side /srv/erp/.env (used by the deploy webhook and compose) and local dev .env copies. Nothing secret goes into git: not in the README, not in dumps, not in docs. The repo is (or was) public — assume anything ever committed is compromised and rotate.

docker-compose.prod.yml declares every production secret as ${VAR:?set in .env} so the stack refuses to boot on defaults.

Where each secret lives

Secret	Used by	Defined in
POSTGRES_PASSWORD	postgres, api	server .env
MINIO_ROOT_USER / MINIO_ROOT_PASSWORD	minio, minio-init, api	server .env
CASDOOR_CLIENT_SECRET	Casdoor application record, api	server .env (must match the app in the Casdoor console)
CASDOOR_ADMIN_PASSWORD	Casdoor console admin, api (/users/sync)	server .env (rotate in the Casdoor console too)
CORS_ORIGINS, *_HOST, TRAEFIK_ACME_EMAIL	compose / Traefik	server .env
GITEA_WEBHOOK_SECRET	deploy-webhook receiver (port 9000)	server .env + Gitea webhook config
Monitoring DSNs/keys	OpenPanel, GlitchTip, Grafana	monitoring/.env (server-side)

Rotation checklist — run after any leak suspicion

The production branch history contained real credentials (MinIO admin, Casdoor passwords, server IP, DB dumps). All of the following must be rotated once, on the VPS:

cd /srv/erp

# 1) MinIO root — then update MINIO_ROOT_* in /srv/erp/.env
mc alias set local http://127.0.0.1:9000 <old-user> '<old-pass>'
mc admin user add local <new-user> '<new-pass>'      # then:
mc admin policy attach local consoleAdmin --user <new-user>
mc admin user remove local <old-user>
# (simplest equivalent: mc admin user svcacct or change root via env +
#  `docker compose up -d minio` — MinIO persists root creds from env)

# 2) PostgreSQL — then update POSTGRES_PASSWORD in .env
docker exec -it procurement-postgres psql -U postgres -c \
  "ALTER USER postgres PASSWORD '<new-strong-password>';"
docker compose up -d api   # api re-reads the DSN from .env

# 3) Casdoor console admin (console → Identity → users → admin → reset
#    password) — then update CASDOOR_ADMIN_PASSWORD in .env
# 4) Casdoor application client secret (console → Applications →
#    inventory-app → edit secret) — then update CASDOOR_CLIENT_SECRET in .env
# 5) Seeded human users: reset each password in the Casdoor console.
# 6) Gitea webhook secret (Gitea → repo → Settings → Webhooks) — then update
#    GITEA_WEBHOOK_SECRET in .env and restart the receiver (systemctl restart erp-deploy-webhook)

# 7) Apply everything:
docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d

• SSH: disable password login (PasswordAuthentication no in /etc/ssh/sshd_config), use keys only, and prefer a non-root user with sudo over root direct login.
• Repo hygiene: keep the repo private until the git history is either purged (BFG / git filter-repo on the README + backups/ blobs) or every leaked value is rotated. Deleting a file in a later commit does not remove it from history.
• Verify: after rotation, docker compose logs api | grep -i error, log into the app, upload + download one attachment, and confirm the webhook deploy still works with a test push.