prole/docs/PROLE-CFG-SECRETS.md

knoe.cfg Secrets

This document describes how secrets are handled in knoe.cfg and where they are stored in OpenBao.

Temporary encrypted values

During installation, secrets are written to knoe.cfg as temporary encrypted values so an interrupted run can resume:

• Format: ${KNOE_SECRET:v1:<nonce_b64>:<ciphertext_b64>}
• Encryption: AES‑256‑GCM
• Key storage:
  • macOS: login Keychain (service knoe-installer)
  • Other platforms: ~/.knoe/secrets/installer.key (0600)

These encrypted values are removed at Post‑Install by running etc/build-a-bao.sh.

OpenBao placeholders

After Post‑Install, secrets in knoe.cfg are replaced with OpenBao placeholders that point to a namespace‑scoped KV path:

• Format: ${OPENBAO:kv/knoe/<namespace>/<leaf>#<key>}

The namespace comes from NAMESPACE in knoe.cfg and makes the file 1:1 with a single knoe-db deployment.

Secrets recorded in knoe.cfg

The following keys are treated as secrets and stored in OpenBao:

knoe.cfg key	OpenBao KV path
Inputs.init_password.db_password	kv/knoe/<namespace>/db#password
Inputs.init_password.db_password_confirm	kv/knoe/<namespace>/db#password
Global.DB_PASSWORD	kv/knoe/<namespace>/db#password
Inputs.kerberos_config.password	kv/knoe/<namespace>/kerberos#password
Kerberos Authentication.PASSWORD	kv/knoe/<namespace>/kerberos#password
Monitoring.GRAFANA_ADMIN_PASSWORD	kv/knoe/<namespace>/monitoring#grafana_admin_password

Post‑Install step

Run the Build‑A‑Bao step on the Post‑Install screen (or etc/build-a-bao.sh) to:

1. Decrypt temporary secrets from knoe.cfg
2. Write them to OpenBao under the namespace path
3. Replace knoe.cfg secrets with OpenBao placeholders