Secrets & Credentials

How Secrets Are Managed

All service credentials in SSERIS are stored as environment variables in stack YAML files on Azure (/home/kaks/stacks/). There are no Docker secrets in use (confirmed: docker secret ls returns empty). Everything is in plaintext env vars within the stack YAMLs. There are no stack files on Contabo — all deployments are managed from Azure.

Where to Find Credentials

Credential	Location	Notes
DEV PostgreSQL password	infrastructure.yml env vars	POSTGRES_PASSWORD
DEV Redis password	infrastructure.yml env vars	If configured
DEV RabbitMQ credentials	infrastructure.yml env vars	RABBITMQ_DEFAULT_USER/PASS
DEV Keycloak admin	infrastructure.yml env vars	KEYCLOAK_ADMIN/KEYCLOAK_ADMIN_PASSWORD
DEV app service configs	services.yml env vars	Database URLs, Keycloak client secrets
UAT PostgreSQL password	uat-infrastructure.yml env vars	POSTGRES_PASSWORD
UAT Keycloak admin	uat-infrastructure.yml env vars	KEYCLOAK_ADMIN/KEYCLOAK_ADMIN_PASSWORD
UAT app service configs	uat-services.yml env vars	Database URLs, Keycloak client secrets
Harbor admin password	shared-infrastructure.yml	HARBOR_ADMIN_PASSWORD
SSL certificates	/etc/letsencrypt/live/ayinza.dev/	Mounted read-only into Nginx
WireGuard keys	/etc/wireguard/wg0.conf	Private and public keys
docs.ayinza.dev	nginx htpasswd Docker config	devops / d3v0psDOCs

Stack Files Location

All stack files with credentials are on Azure at:

/home/kaks/stacks/
├── infrastructure.yml          # DEV infra credentials
├── services.yml                # DEV app credentials
├── uat-infrastructure.yml      # UAT infra credentials
├── uat-services.yml            # UAT app credentials
├── shared-infrastructure.yml   # Harbor, Nexus credentials
├── nginx.yml                   # Nginx configs references
├── superset.yml                # Superset configuration
├── uat-garage.toml             # UAT Garage S3 configuration
└── ssra-realm-export.json      # Keycloak realm config

Security Considerations

• Stack YAML files contain plaintext credentials — access to Azure SSH means access to all credentials
• The authorized_keys files on both servers control who can access these credentials
• Rotate credentials periodically, especially after team member changes