STD-006: Secrets Handling

Rules governing credential management, secret access, and secure storage across all domus repositories and workstations. Verify presence and accessibility — never content.

Principles

  1. Secrets are inviolable. Never decrypt .age files programmatically, read ~/.secrets/, execute age -d in automation, or surface any credential value. Document paths; never reveal values.

  2. Presence, not content. Validation checks verify that secrets EXIST and are ACCESSIBLE. They MUST NOT print, log, or display secret values.

  3. Each machine owns its keys. Private keys MUST NOT be shared across machines. Each workstation gets its own keypair, its own Vault cert, its own gopass clone.

  4. Encrypted at rest. Secrets not actively in use MUST be encrypted. Use gocryptfs for credential vaults, age for file encryption, LUKS for disk encryption.

Requirements

  1. Credentials, tokens, API keys, and secret values MUST NOT appear in any .adoc document, commit message, or log output. Redact with <REDACTED>.

  2. gopass store paths and Vault policy names are acceptable to document. Secret values stored within them are not.

  3. Private keys (~/.ssh/id_*, ~/.gnupg/, ~/.age/identities) MUST NOT be committed to any git repository.

  4. Each workstation MUST have its own SSH keypair, GPG key, and EAP-TLS certificate. Never copy private keys between machines.

  5. gocryptfs vaults MUST be unmounted when not in active use. Sensitive tooling (Claude Code config, gh CLI tokens) SHOULD be symlinked from the mounted vault.

  6. After rsync’ing ~/.gnupg/ to a new machine, GPG lock files MUST be cleared and gpg-agent restarted before use. Lock files contain source machine PIDs.

  7. After gopass bootstrap on a new machine, gopass config MUST be verified to show the correct root store path.

  8. SSH config containing hostnames and connection details MUST be age-encrypted before committing: age -e -R ~/.age/recipients/self.txt.

Compliance

Check Method Pass Criterion

No secrets in docs

grep -riE 'password|token|secret|apikey' pages/ | grep -v REDACTED | grep -v gopass | grep -v pattern

Zero real credentials

No private keys in git

git ls-files | grep -E 'id_rsa|id_ed25519[^.]' | grep -v '.pub|.age'

Zero private key files tracked

SSH config encrypted

git ls-files | grep 'ssh.*config$' should be empty; ssh/.ssh/config.age tracked

Only .age version in git

gocryptfs vault mountable

gcvault mount credentials && ls ~/.credentials/

Mount succeeds, contents accessible

gopass accessible

gopass ls | head -3

Store listed without error

Exceptions

None. All requirements apply unconditionally.

Related