secrets: migrate exposed plaintext secrets to git-crypt

Move all hardcoded credentials out of tracked compose/env files into the
git-crypt-encrypted secrets/ directory, using each app's supported mechanism:

- env_file -> secrets/*.env: mealie, navidrome, karakeep, meilisearch,
  baserow, maloja, valheim, photoprism, komf, openldap, penpot, vaultwarden
- file:///run/secrets: authentik email password
- jelu DB password appended to existing secrets/jelu.env

Untrack root .env (interpolated ${VAR} secrets) and add sanitized
.env.example template; gitignore /.env.

Move unreferenced orphan files (mediawiki/rtorrent/snibox .env) into
secrets/ to preserve values while encrypting them.

Add SECURITY.md documenting the secrets conventions and a rotation
checklist. NOTE: all migrated values remain in prior git history and
must be rotated at their providers.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

This commit was merged in pull request #1.

This commit is contained in:

Lukáš Kucharczyk

2026-06-12 13:15:25 +02:00

parent d35a9cf672

commit 5aa85b0920

32 changed files with 136 additions and 36 deletions

									
										maloja.env
									
		+1
		-1
	
												View File
												
				@@ -1,2 +1,2 @@

				MALOJA_DATA_DIRECTORY=/data

				MALOJA_FORCE_PASSWORD=kralovna

				# MALOJA_FORCE_PASSWORD provided via secrets/maloja.env