# knoe.cfg Secrets

This document describes how secrets are handled in `knoe.cfg` and where they are stored.

## External secret store: 1Password (`knoey` vault)

The master database password (`administrator`) is stored in a dedicated 1Password vault called **`knoey`**, isolated from the user's personal vaults.

| 1Password item | Field | Purpose |
|---|---|---|
| `administrator` | `password` | Database master password (formerly in Ansible vault) |
| `k3s-token` | `credential` | k3s cluster join token |
| `samba-dns-admin` | `password` | Samba/AD DNS admin password |

`install.sh` creates the `knoey` vault and the `administrator` item on first run (via `etc/init_1password.sh`). The `op` CLI (`brew install 1password-cli`) is required.

## Temporary encrypted values

During installation, secrets are written to `knoe.cfg` as temporary encrypted values so an interrupted run can resume:

- Format: `${KNOE_SECRET:v1:<nonce_b64>:<ciphertext_b64>}`
- Encryption: AES‑256‑GCM
- Key storage:
  - macOS: login Keychain (service `knoe-installer`)
  - Other platforms: `~/.knoe/secrets/installer.key` (0600)

These encrypted values are removed at Post‑Install by running `etc/build-a-bao.sh`.

## OpenBao placeholders

After Post‑Install, secrets in `knoe.cfg` are replaced with OpenBao placeholders that point to a namespace‑scoped KV path:

- Format: `${OPENBAO:kv/knoe/<namespace>/<leaf>#<key>}`

The namespace comes from `NAMESPACE` in `knoe.cfg` and makes the file 1:1 with a single `knoe-db` deployment.

## Secrets recorded in knoe.cfg

The following keys are treated as secrets and stored in OpenBao:

| knoe.cfg key | OpenBao KV path |
| --- | --- |
| `Inputs.init_password.db_password` | `kv/knoe/<namespace>/db#password` |
| `Inputs.init_password.db_password_confirm` | `kv/knoe/<namespace>/db#password` |
| `Global.DB_PASSWORD` | `kv/knoe/<namespace>/db#password` |
| `Inputs.kerberos_config.password` | `kv/knoe/<namespace>/kerberos#password` |
| `Kerberos Authentication.PASSWORD` | `kv/knoe/<namespace>/kerberos#password` |
| `Monitoring.GRAFANA_ADMIN_PASSWORD` | `kv/knoe/<namespace>/monitoring#grafana_admin_password` |

## Post‑Install step

Run the Build‑A‑Bao step on the Post‑Install screen (or `etc/build-a-bao.sh`) to:

1) Decrypt temporary secrets from `knoe.cfg`
2) Write them to OpenBao under the namespace path
3) Replace `knoe.cfg` secrets with OpenBao placeholders