Secrets & credentials

1. Secrets & credentials

NO secret ever live in this repo or its git history:

Secret Where / how to get it

Secret	Where / how to get it
Infra logins (Kasm, Proxmox API tokens, admin passwords, service accounts)	osisa KeePass store `NETSetup.kdbx`. Open with `osisa.KeePass.Cli` (master pass in env `$NETSETUP_Masterpassword`). Use `osisa-keepass` skill.
NixOS VM secrets (luks, service creds)	SOPS-encrypted `secrets.yaml` per host under `src/NETSetup/nixos/hosts/<host>/`. See `nixos-sops-secrets` skill.
Dropbox boot-asset access	`appsettings.json` → `DropboxOptions` next to exe, never in git.
SSL / Let’s Encrypt material	`.secrets/` + `.ssl-scratch/` (gitignored). See `ssl-osisa` skill.

Infra logins (Kasm, Proxmox API tokens, admin passwords, service accounts)

osisa KeePass store NETSetup.kdbx. Open with osisa.KeePass.Cli (master pass in env $NETSETUP_Masterpassword). Use osisa-keepass skill.

NixOS VM secrets (luks, service creds)

SOPS-encrypted secrets.yaml per host under src/NETSetup/nixos/hosts/<host>/. See nixos-sops-secrets skill.

Dropbox boot-asset access

appsettings.json → DropboxOptions next to exe, never in git.

SSL / Let’s Encrypt material

.secrets/ + .ssl-scratch/ (gitignored). See ssl-osisa skill.