project-charlie/docs/secrets.md

Secrets

flowchart LR
  StackRepo[Stack repo secrets/] --> SOPS[SOPS ciphertext]
  SOPS -->|age recipient| HostKey["/etc/charlie/age.key"]
  HostKey --> Deploy[Deploy on target host]
  Deploy --> Plaintext["Plaintext env/config"]
  Plaintext --> Compose[docker compose]

Area	Current state
Stack secrets	SOPS-encrypted files under each stack repo's secrets/.
Decryption	Target host decrypts with /etc/charlie/age.key.
Admin recovery	Admin age key listed in every relevant .sops.yaml.
Human vault	Vaultwarden stores human-facing secrets and PAT notes.
Plaintext	Deploy-time only; ignored by Git.

Key material

Secret/key	Owner	Location
Host age private key	each host	/etc/charlie/age.key
Host age public key	docs	hosts
Admin age private key	operator	vaultwarden Secure Note Charlie SOPS admin age key
Registry RO PAT ciphertext	project-charlie	inline in deploy-stack.yml

PATs

Identity	Scope	Used for
sys-gitea-runner	read:repository	workflow/action fetches and host Git sync.
sys-gitea-runner	read:package	registry pulls during deploy.
sys-host-<host>	read:repository	host-local root Git operations.
sys-host-<host>	read:package	host-local root registry pulls.
caller user/org	read:repository	source-repo build workflow fetch/clone.
caller user/org	write:package	source-repo image push.

Registry and repo credentials are separate on purpose.