prole/docs/PROLE-CFG-SECRETS.md

knoe.cfg Secrets

This document describes how secrets are handled in knoe.cfg and where they are stored.

External secret store: 1Password (knoey vault)

The master database password (administrator) is stored in a dedicated 1Password vault called knoey, isolated from the user's personal vaults.

1Password item	Field	Purpose
administrator	password	Database master password (formerly in Ansible vault)
k3s-token	credential	k3s cluster join token
samba-dns-admin	password	Samba/AD DNS admin password

install.sh creates the knoey vault and the administrator item on first run (via etc/init_1password.sh). The op CLI (brew install 1password-cli) is required.

Temporary encrypted values

During installation, secrets are written to knoe.cfg as temporary encrypted values so an interrupted run can resume:

• Format: ${KNOE_SECRET:v1:<nonce_b64>:<ciphertext_b64>}
• Encryption: AES‑256‑GCM
• Key storage:
  • macOS: login Keychain (service knoe-installer)
  • Other platforms: ~/.knoe/secrets/installer.key (0600)

These encrypted values are removed at Post‑Install by running etc/build-a-bao.sh.

OpenBao placeholders

After Post‑Install, secrets in knoe.cfg are replaced with OpenBao placeholders that point to a namespace‑scoped KV path:

• Format: ${OPENBAO:kv/knoe/<namespace>/<leaf>#<key>}

The namespace comes from NAMESPACE in knoe.cfg and makes the file 1:1 with a single knoe-db deployment.

Secrets recorded in knoe.cfg

The following keys are treated as secrets and stored in OpenBao:

knoe.cfg key	OpenBao KV path
Inputs.init_password.db_password	kv/knoe/<namespace>/db#password
Inputs.init_password.db_password_confirm	kv/knoe/<namespace>/db#password
Global.DB_PASSWORD	kv/knoe/<namespace>/db#password
Inputs.kerberos_config.password	kv/knoe/<namespace>/kerberos#password
Kerberos Authentication.PASSWORD	kv/knoe/<namespace>/kerberos#password
Monitoring.GRAFANA_ADMIN_PASSWORD	kv/knoe/<namespace>/monitoring#grafana_admin_password

Post‑Install step

Run the Build‑A‑Bao step on the Post‑Install screen (or etc/build-a-bao.sh) to:

1. Decrypt temporary secrets from knoe.cfg
2. Write them to OpenBao under the namespace path
3. Replace knoe.cfg secrets with OpenBao placeholders