Infrastructure
Secrets
Secret inventory, storage locations, and rotation policy — no values.
Secrets
This page inventories credentials and secrets by name only. Never commit secret values to Git or documentation.
Policy
| Rule | Detail |
|---|---|
| Git | Secrets must never enter the repository |
| Documentation | Document names, consumers, and storage — never values |
| Scope | Minimum required permissions for each credential |
| Rotation | Rotate at provider/UI level; update Dokploy env or host files |
Storage models
| Model | Used for | Example |
|---|---|---|
| Dokploy environment variables | Application runtime secrets | DATABASE_URL, SENTRY_DSN |
| Host filesystem (restricted permissions) | Infrastructure secrets Traefik reads | Cloudflare DNS API token |
Local .env (git-ignored) | Developer workstation only | Local Postgres password |
Secret inventory
| Secret / credential | Consumer | Storage location | Scope / permissions | Repository policy | Status |
|---|---|---|---|---|---|
DATABASE_URL | migrate, API | Dokploy env (staging) | Internal PostgreSQL access | .env.example shows format only; never real staging creds | Active (staging) |
| Cloudflare DNS API token | Traefik (letsencrypt-cloudflare) | Host: /etc/dokploy/traefik/secrets/cloudflare-dns-api-token | Zone Read + DNS Edit on getbytebite.co only | Never in Git | Active (staging) |
SENTRY_DSN | API (via @bytebite/observability) | Dokploy env | Project-specific DSN | Optional locally; placeholder in .env.example | Configured (optional) |
STAGING_BASIC_AUTH_USERS | Traefik (compose labels) | Dokploy env (staging compose) | Shared staging HTTP BasicAuth | Generate with infrastructure/scripts/staging-htpasswd.sh; never commit | Active (staging) |
BETTER_AUTH_SECRET | API (Better Auth) | Dokploy env (staging); local .env | Staff session signing | Placeholder in .env.example (local/test only; never a production default) | Active |
STRIPE_SECRET_KEY | API (future) | Dokploy env (planned) | Stripe API | Empty placeholders in .env.example | Not implemented |
STRIPE_PUBLISHABLE_KEY | Storefront (future) | Build-time env (planned) | Public key | Empty placeholder | Not implemented |
STRIPE_WEBHOOK_SECRET | API (future) | Dokploy env (planned) | Webhook verification | Empty placeholder | Not implemented |
AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY | API (SES send, scaffold) | Dokploy env (planned) | SES send permissions | Empty placeholders; no-op without values | Scaffolded (optional) |
AWS_REGION | API (SES send, scaffold) | Dokploy env (planned) | SES region | Empty placeholder; required together with keys + from-address | Scaffolded (optional) |
SES_FROM_EMAIL | API (SES send, scaffold) | Dokploy env (planned) | Verified sender | Empty placeholder; no-op without value | Scaffolded (optional) |
TWILIO_ACCOUNT_SID / TWILIO_AUTH_TOKEN | API (SMS send + status stub) | Dokploy env (planned) | SMS send; webhook HMAC | Empty placeholders; no-op / 503 without values | Scaffolded (optional) |
TWILIO_MESSAGING_SERVICE_SID | API (unused placeholder) | Dokploy env (planned) | Messaging service | Empty placeholder; sends use sender ByteBite in code | Unused |
S3_ACCESS_KEY_ID / S3_SECRET_ACCESS_KEY | API | Local .env (MinIO defaults) | S3 bucket access | Dev placeholders only | Local dev only |
MAPBOX_ACCESS_TOKEN | API | Dokploy env (planned); local .env | Search + permanent geocoding | Empty placeholder; suggest/quote/delivery checkout 503 without it; pickup still runs | Active (optional) |
| ACME account keys | Traefik | acme.json, acme-cloudflare.json | Let's Encrypt account | Host filesystem only | Active |
| Restic repository password | Restic backup / restore | Host: /etc/bytebite/backups/restic-password | Restic repository encryption | Never in repository; off-host credential manager required | Active (staging) |
| B2 S3-compatible credentials (backup) | Restic | Host: /etc/bytebite/backups/restic.env | Dedicated backup storage bucket access | Never in repository | Active (staging) |
| Dokploy admin credentials | Dokploy UI | Dokploy internal | Full deployment access | Not in repository | Active |
| SSH keys | Server access | Operator workstations | Server administration | Not in repository | Active |
Cloudflare DNS API token
| Attribute | Value |
|---|---|
| File | /etc/dokploy/traefik/secrets/cloudflare-dns-api-token |
| Permissions | 600, root:root |
| Container mount | /run/secrets/cloudflare-dns-api-token via CF_DNS_API_TOKEN_FILE |
| Required scopes | Zone Read + DNS Edit on getbytebite.co |
| Optional hardening | Source IP restriction to 88.99.0.118/32 |
The token value must never appear in documentation.
Restic and B2 backup credentials
PostgreSQL off-host backups use Restic with Backblaze B2. Credentials are stored on BYTEBITE-APP-01 under /etc/bytebite/backups/:
| File | Consumer | Permissions |
|---|---|---|
/etc/bytebite/backups/restic.env | Restic | Root-owned, restrictive |
/etc/bytebite/backups/restic-password | Restic | Root-owned, restrictive |
| Attribute | Detail |
|---|---|
restic.env contains | Repository target, credential environment, password-file reference |
restic-password contains | Restic repository encryption password |
| Repository policy | Never commit to Git |
| Off-host copy | Restic password must exist in a secure off-host credential manager |
Never document or reproduce the contents of these files. Losing both the VM and the Restic encryption password makes encrypted backups unrecoverable from B2 alone.
B2 backup credentials are dedicated to backup storage and are separate from future application media S3 credentials.
Rotation (conceptual)
- Generate new credential at the provider (Cloudflare, Stripe, etc.).
- Update Dokploy environment or host filesystem file.
- Restart affected services (API containers for app secrets;
dokploy-traefikfor DNS token). - Verify with Validation smoke tests.
- Revoke old credential at provider.
For Traefik DNS token rotation, also verify wildcard TLS issuance after restart.
Staging BasicAuth (STAGING_BASIC_AUTH_USERS) rotation: generate a new hash, update Dokploy, redeploy the compose application (restart is not enough), then verify unauthenticated 401 and authenticated health checks.
Related
- TLS — Cloudflare token usage
- Security — trust boundaries
- Operations — rotation procedures
.env.example— local placeholder names (no real secrets)