Skip to content

Administrator guide

Protect connections and secrets

Separate secret-bearing setup and runtime state from profiles, logs, source control, and ordinary support output.

A Server is only as much of a trust boundary as the material that unlocks it. Treat setup files, recovery bundles, and credentials as part of that boundary, not as incidental files.

Secret red lines

  • Never commit deploy.toml, instance.env, provider keys, recovery codes, owner credentials, bootstrap tokens, or private SSH identities.
  • Never paste them into an issue, support transcript, screenshot, or a command line that shell history will retain.
  • Keep deploy.toml and managed instance.env at mode 0600, in directories private to the operator account.
  • Keep profiles non-secret — opencircle profile current is designed to be safe to inspect, not a secret vault.
  • Treat a recovery bundle as secret-bearing operational material even though the verify command redacts its report.

An environment reference such as { fromEnv = "NAME" } keeps a value out of the setup file — it does not protect the environment that supplies it. Clear temporary values once setup finishes.

Bootstrap authority expires

A first-install bootstrap token authorizes setup; it is not the durable day-two authority for remote Compose operation. Remote lifecycle changes are authorized through the configured SSH identity and Docker privilege instead.

Rotation is a complete operation

For any provider or connection secret: create the replacement at the provider, update it through the owning OpenCircle configuration path, prove the affected capability while the old credential still works, revoke the old credential, and confirm logs and shell history did not capture it.

If a secret was exposed, revoke or rotate it at its authority first. Deleting a line from Git does not invalidate a credential already copied elsewhere.