commit 30fc381a837df49ec2383d04d48110423631ab59
Author: Claude <noreply@anthropic.com>
Date:   Sat May 30 21:20:07 2026 +0200

    ops: secrets + Cloudflare origin cert (private repo)

diff --git a/cloudflare/origin.crt b/cloudflare/origin.crt
new file mode 100644
index 0000000..5dc4806
--- /dev/null
+++ b/cloudflare/origin.crt
@@ -0,0 +1,27 @@
+-----BEGIN CERTIFICATE-----
+MIIEpjCCA46gAwIBAgIUFcII1IBOHbo8DCMGV40NykmuMhkwDQYJKoZIhvcNAQEL
+BQAwgYsxCzAJBgNVBAYTAlVTMRkwFwYDVQQKExBDbG91ZEZsYXJlLCBJbmMuMTQw
+MgYDVQQLEytDbG91ZEZsYXJlIE9yaWdpbiBTU0wgQ2VydGlmaWNhdGUgQXV0aG9y
+aXR5MRYwFAYDVQQHEw1TYW4gRnJhbmNpc2NvMRMwEQYDVQQIEwpDYWxpZm9ybmlh
+MB4XDTI2MDUzMDE5MDkwMFoXDTQxMDUyNjE5MDkwMFowYjEZMBcGA1UEChMQQ2xv
+dWRGbGFyZSwgSW5jLjEdMBsGA1UECxMUQ2xvdWRGbGFyZSBPcmlnaW4gQ0ExJjAk
+BgNVBAMTHUNsb3VkRmxhcmUgT3JpZ2luIENlcnRpZmljYXRlMIIBIjANBgkqhkiG
+9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsLDK2KkODaU0hoeIuWDaE1vxrc16RXAf3ze9
+hN4Kj4/+jUnc7FH/EsNCbw1OdWw7ap9V2mQcvhinZ6YgxyCCtnK7DMFi2nu4km+w
+zyLsfH34/zLAxYc8B3l2DufeOtWHEmuHBEVMTiSke6Taac+x3W0xrOxEhA6k0bB4
+KQ1VN+mWXf1I7Crrpylf6KRQdX/51e9sTrDdq7qft3kcOFvLmxjPWIY84vkfIBFM
+tn7TY3TxfkmFkgE6D7cdczWkfUEDpoo6K+3Q9fPnkGrayVvIqYlVf4jAqsj9I2NP
+y+kzwmK9hTtTIft4kQ9BV+M9UlcI/wGTzgBHwH17mDIyQ58sxQIDAQABo4IBKDCC
+ASQwDgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcD
+ATAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBSlUs/S8SfJ7zJ4Qnkst5NhMTMGtzAf
+BgNVHSMEGDAWgBQk6FNXXXw0QIep65TbuuEWePwppDBABggrBgEFBQcBAQQ0MDIw
+MAYIKwYBBQUHMAGGJGh0dHA6Ly9vY3NwLmNsb3VkZmxhcmUuY29tL29yaWdpbl9j
+YTApBgNVHREEIjAggg8qLmNhbm5hYnVkZHkuZXWCDWNhbm5hYnVkZHkuZXUwOAYD
+VR0fBDEwLzAtoCugKYYnaHR0cDovL2NybC5jbG91ZGZsYXJlLmNvbS9vcmlnaW5f
+Y2EuY3JsMA0GCSqGSIb3DQEBCwUAA4IBAQB/VQDPSK1+qNubUaJZ4kSURLdWALVQ
+TVhVGNm2JjDu7RmLeNoS5cTRdUOUkql6dhQPfhA0TncvfBxC58mI/be5XDr4d9BN
+WVbtBzB1/viUlqupaTdOcl+0XcXfR4pANAc1CYzQeoVaL2EOCJxghPAHScjqbf3p
+HLoIIiaVKjLXPxyKvH7rykqvbzYKeyCI0R4pxbCoQT0K9h6p4+gcD37cjKg5uNcp
+bvwMz8KQznuNE5BbZtsUNdxF/OOJwvlKH+MIsYHe3qkttUOn+9dW1mmAEydXymxr
+zT2aXRkatXHls2wCLwnd/1AKBYe9m8cDravjvOBSDhG5eaxagVtiHlZw
+-----END CERTIFICATE-----
diff --git a/cloudflare/origin.key b/cloudflare/origin.key
new file mode 100644
index 0000000..4b1fc56
--- /dev/null
+++ b/cloudflare/origin.key
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQCwsMrYqQ4NpTSG
+h4i5YNoTW/GtzXpFcB/fN72E3gqPj/6NSdzsUf8Sw0JvDU51bDtqn1XaZBy+GKdn
+piDHIIK2crsMwWLae7iSb7DPIux8ffj/MsDFhzwHeXYO59461YcSa4cERUxOJKR7
+pNppz7HdbTGs7ESEDqTRsHgpDVU36ZZd/UjsKuunKV/opFB1f/nV72xOsN2rup+3
+eRw4W8ubGM9Yhjzi+R8gEUy2ftNjdPF+SYWSAToPtx1zNaR9QQOmijor7dD18+eQ
+atrJW8ipiVV/iMCqyP0jY0/L6TPCYr2FO1Mh+3iRD0FX4z1SVwj/AZPOAEfAfXuY
+MjJDnyzFAgMBAAECggEAFmIbHFXUOi3MyOMYErXegnfSFryySeQhoX838sJHL7cj
+3eW2xzg++jNCsftLTmxK3Z+4Ok2W540LfgGpYthvPqoroHrKKVflgqWEDkWEFGRH
+/BpDmfJfDCpapppAiI7+yLpW9RdLSpXxQVmZsrBVPbIEyj13E4ygXBEBM+AkxMuM
+a95AWZXBsfYPeKVzzbntB5U2i1fJfkyJbP2Izp6dtPOaNObhSAXKPrYNhog/OY8L
+CRJl4/goLxioBeRuNXM711YWQDs3YpoAWuqJ4wcknVonwcjZr1lsAu/9N0eTIqr4
+in4VO9RtX1LcwHU1yTqqrI+bBE2vFr1Xse5IQpKjyQKBgQDdMfr2SX96xWwWGPBQ
+fxgZZnWTtxkAO63yMaIIfOtqYi9hrldNt57NZPb7HL0B7wDVX1ITFqSowNIHj3V/
+jJ7X+lGpAUzKBdi4E7ZDkVlU+NrNr3Kc+0w/yNn1yDlphkSbQu6M/KUwjs/Dypn0
+b1zDaQGKKlxJoqvFG7wDayNGzQKBgQDMfhwUJz/PdiP0oYW30YkSBo1mNTwW8T1W
+FOKPyM7u2G9ZAVQAACSemj8i3B0FLc1hy/3atVR3/B2QWXMB5Fb8YJunFo5yBpyO
+HVf90/TtJkFLSxOK4F18Jk9I2K+dhD7IGzKA2Mq3PQUgCOuhmdC3h5tjx83K9qsl
+4H+0gx7N2QKBgHa/MTps5KoVOFx4kPK1+EsSjUZ6wko0v8JI0PL7lSpsgYFQJgBL
+9k3PySOwHuvd0jW6UYZ73nPV6Cs04eBSrqfF83bmgsHl952Cv5NwgWOzoUtQyBfs
+dNe9TP28us2izkwH16cKruftky5KIvJtooApbDEvYpIJaWuM4xd2ud51AoGAHRpJ
+hri7RRxMK7GdJTcF6fHSx9wFrEIy94BLaikrAiT9W85rlQBwNb5ABAcNfkIxe5yb
+iTfLSLQxxOxmCLvlgU+Cd3onVaUJPNSCRFaZAfMy0bNimZ4qz9Nn7zcfbyx1/uaX
+/mxcFU3y38dFOZ95a9U50S6LZDpMyzwzEI6koKkCgYB3gjiA0r4k+1vaCJNMVOnw
+vHmr88FU+8rc/xW1ELLtp38+1QU66cRToc9nTT4eBSS/brxoesFmv3HQzTjoJztO
+UjxH2Yrs/A0Qtpx4tYZyVaGB7gmak2HufetOEzUt1LvYw2+ZpYyE2ef4/dX6G3Hr
+U+E/cfX62+RRUV6J1o6B0A==
+-----END PRIVATE KEY-----
diff --git a/passwords.md b/passwords.md
new file mode 100644
index 0000000..a657914
--- /dev/null
+++ b/passwords.md
@@ -0,0 +1,46 @@
+# CannaBuddy — secrets & access (PRIVATE)
+
+**Keep this repo PRIVATE on Forgejo. Do NOT mirror into `cloud`/`docs`/`firmware`
+(those are touched by CI + Seb).** Rotate anything that was pasted into a chat.
+
+_Last updated: 2026-05-30 (new-VPS bring-up)._
+
+---
+
+## New server — cannabuddy.eu (prod target)
+- Provider VPS: **VPSID 16581 / VID 16422**
+- IPv4: **181.214.99.11**  · IPv6: **2a0f:5707:aaf1:210c::1**
+- OS: Debian 12 (bookworm), 4 vCPU (Ryzen 9 7950X), 8 GB RAM, 99 GB disk
+- root password: `wirsindcool2002`  ⚠️ **rotate** (SSH password-login already disabled — key-only)
+- SSH: **key-only**, `ufw` (22/80/443), `fail2ban`, unattended-upgrades — all on.
+
+## Old server — Netcup (decommission later)
+- Host: `weed.dahlner.de` · user `root`
+- SSH key (local): `~/.ssh/id_ed25519_hydrobuddy`
+- App env secrets live at: `/home/dahlner-weed/services/secrets/*.env`
+
+## SSH keys
+- **claude (automation):** local `~/.ssh/id_ed25519_cannabuddy` (no passphrase).
+  Public: `ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOTuQO21ERtWo7msOD/4r1fHw0XOj9jTbt/dtEjrXktG claude@cannabuddy`
+- **KJ desktop:** _TODO — paste pubkey, add to /root/.ssh/authorized_keys_
+- **KJ Termius (mobile):** _TODO — paste pubkey, add to /root/.ssh/authorized_keys_
+
+## Domain / Cloudflare
+- `cannabuddy.eu` — DNS + proxy (WAF) in Cloudflare.
+- DNS: `A/AAAA @` + `A/AAAA app` → the IPs above, **proxied (orange)**. No wildcard.
+- **Cloudflare Origin Certificate** (`*.cannabuddy.eu`, `cannabuddy.eu`, exp 2041):
+  - files: `cloudflare/origin.crt` + `cloudflare/origin.key` (this repo)
+  - on box: `/etc/ssl/cannabuddy/origin.crt` + `origin.key` (root, 0600)
+  - CF SSL/TLS mode must be **Full (strict)**.
+- _TODO: Cloudflare API token (Zone:DNS:Edit) — only needed if we ever switch to ACME DNS-01 instead of the origin cert._
+
+## Email — SendKit
+- Account domain: cannabuddy.eu
+- API key: `sk_uKbxm1S3UCmQkOcCzVpuUFDPELseLw03czZ9exjOoRDsHgO9`  ⚠️ rotate (was in chat)
+- _TODO: SPF / DKIM / DMARC DNS records in Cloudflare (values from SendKit)._
+
+## App secrets — to generate fresh on the new box (do NOT reuse old)
+- `DATABASE_URL` (TimescaleDB role + password) — _TODO_
+- Better-Auth secret (`BETTER_AUTH_SECRET`) — _TODO (openssl rand -hex 32)_
+- NanoMQ ↔ cloud auth-hook shared secret / device-token signing — _TODO_
+- Forgejo: admin creds + CI runner registration token + deploy SSH key — _TODO_