# prole.cfg Secrets

This document describes how secrets are handled in `prole.cfg` and where they are stored in OpenBao.

## Temporary encrypted values

During installation, secrets are written to `prole.cfg` as temporary encrypted values so an interrupted run can resume:

- Format: `${PROLE_SECRET:v1:<nonce_b64>:<ciphertext_b64>}`
- Encryption: AES‑256‑GCM
- Key storage:
  - macOS: login Keychain (service `prole-installer`)
  - Other platforms: `~/.prole/secrets/installer.key` (0600)

These encrypted values are removed at Post‑Install by running `etc/build-a-bao.sh`.

## OpenBao placeholders

After Post‑Install, secrets in `prole.cfg` are replaced with OpenBao placeholders that point to a namespace‑scoped KV path:

- Format: `${OPENBAO:kv/prole/<namespace>/<leaf>#<key>}`

The namespace comes from `NAMESPACE` in `prole.cfg` and makes the file 1:1 with a single `knoe-db` deployment.

## Secrets recorded in prole.cfg

The following keys are treated as secrets and stored in OpenBao:

| prole.cfg key | OpenBao KV path |
| --- | --- |
| `Inputs.init_password.db_password` | `kv/prole/<namespace>/db#password` |
| `Inputs.init_password.db_password_confirm` | `kv/prole/<namespace>/db#password` |
| `Global.DB_PASSWORD` | `kv/prole/<namespace>/db#password` |
| `Inputs.kerberos_config.password` | `kv/prole/<namespace>/kerberos#password` |
| `Kerberos Authentication.PASSWORD` | `kv/prole/<namespace>/kerberos#password` |
| `Monitoring.GRAFANA_ADMIN_PASSWORD` | `kv/prole/<namespace>/monitoring#grafana_admin_password` |

## Post‑Install step

Run the Build‑A‑Bao step on the Post‑Install screen (or `etc/build-a-bao.sh`) to:

1) Decrypt temporary secrets from `prole.cfg`
2) Write them to OpenBao under the namespace path
3) Replace `prole.cfg` secrets with OpenBao placeholders