lab.example.yaml

---
# Template for secrets/lab.sops.yaml.
#
# FIVE KEYS: Grafana's admin password and the ingest proxy's four tokens
# (#834). The short list is worth reading as a description of the stack: no SNMP
# communities, because it polls no devices; no Alertmanager receiver URLs,
# because it has no Alertmanager (ADR-0020); no renderer token, because it
# ships no dashboards to screenshot.
#
# scripts/render-config.sh derives the required set per stack rather than
# demanding all ten the estate needs, so `make render STACK=lab` asks for this
# and nothing else.
#
# ---------------------------------------------------------------------------
# Create this ON THE LAB GUEST, not on the monitoring host
# ---------------------------------------------------------------------------
#
#   make secrets-init STACK=lab    # first time only — creates the age keypair
#   make secrets-edit STACK=lab    # opens the encrypted file in $EDITOR
#
# `.sops.yaml` gives secrets/lab.*.sops.yaml its own creation_rule and its own
# age recipient, above the catch-all that covers everything else under
# secrets/. That separation is the point: the single rule it sits above matches
# ALL of secrets/, so a key added there could decrypt the estate's SNMP
# communities and Grafana admin password too — a lab host holding the
# credentials of the estate it is meant to be isolated from.
#
# `make secrets-init STACK=lab` run on the monitoring host would do exactly
# that, which is why bootstrap.sh now refuses when the key it would write is
# already a recipient of another rule. Run it where the stack runs.

# Grafana initial admin login. Grafana only reads this when it creates the
# admin user, so changing it later has no effect — change it in the UI, or wipe
# the grafana-data volume.
#
# NOT the same password as the estate's Grafana. Two Grafanas that share a
# password are one credential, and the whole reason there are two of them is
# that the lab is assumed to be the one that gets compromised. Generate one
# with `make gen-secret`.
GRAFANA_ADMIN_PASSWORD: change-me-to-something-long

# GRAFANA_ADMIN_USER is optional and defaults to `admin` in compose.yaml. Add
# it here if you want a different one.

# The ingest proxy's tokens (#834, stacks/lab/Caddyfile): one per client that
# pushes here, and one for reading. Each is generated HERE, with
# `openssl rand -hex 32`, and then copied to its client:
#
#   INGEST_TOKEN_ODIN     -> INGEST_TOKEN in secrets/soc.sops.yaml, on odin
#   INGEST_TOKEN_FENRIR   -> INGEST_TOKEN in secrets/sensor.sops.yaml, on fenrir
#   INGEST_TOKEN_PHOENIX  -> exported as INGEST_TOKEN on the Mac, when
#                            deploy-agent.sh ships phoenix's agent
#   INGEST_TOKEN_GOLEM    -> the same, for golem's agent (ADR-0053)
#   INGEST_TOKEN_EDEN     -> INGEST_TOKEN in secrets/bloodhound.sops.yaml, on eden
#                            (ADR-0081)
#   INGEST_TOKEN_GARUDA   -> INGEST_TOKEN in secrets/analyst.sops.yaml, on garuda
#                            (ADR-0091)
#   INGEST_TOKEN_READER   -> exported as INGEST_TOKEN_READER the same way, for
#                            that script's arrival check
#
# Two copies of each, on purpose: no host here can open another stack's file.
# NOT the estate's tokens, and never copied from them: a lab host holding an
# estate credential is the inversion ADR-0007 forbids. render-config.sh refuses
# one shorter than 32 characters, or two that are equal.
INGEST_TOKEN_ODIN: change-me-openssl-rand-hex-32
INGEST_TOKEN_PHOENIX: change-me-openssl-rand-hex-32
INGEST_TOKEN_FENRIR: change-me-openssl-rand-hex-32
INGEST_TOKEN_GOLEM: change-me-openssl-rand-hex-32
INGEST_TOKEN_EDEN: change-me-openssl-rand-hex-32
INGEST_TOKEN_GARUDA: change-me-openssl-rand-hex-32
INGEST_TOKEN_READER: change-me-openssl-rand-hex-32

# golem's backup encryption key (ADR-0053, build-the-backup-guest.md §7): the
# whole of Saruman's /etc/pve/priv/storage/golem.enc, kept here so a rebuilt
# Saruman can read its own backups. ONE LINE, compact JSON in single quotes;
# set it with `sops set` as the runbook's §7 shows, not here. Pasted as the file's own
# multi-line JSON, YAML reads it as a nested map, and scripts/secrets-env.sh,
# which takes flat `KEY: value` lines only, refuses the whole file, so
# `make render STACK=lab` fails. It is not a compose variable, so
# render-config.sh never writes it to the stack's .env.
PBS_ENCRYPTION_KEY: '{"kdf":null,"created":"…","modified":"…","data":"…","fingerprint":"…"}'