# CannaBuddy — secrets & access (PRIVATE)

**Keep this repo PRIVATE on Forgejo. Do NOT mirror into `cloud`/`docs`/`firmware`
(those are touched by CI + Seb).** Rotate anything that was pasted into a chat.

_Last updated: 2026-05-30 (new-VPS bring-up)._

---

## New server — cannabuddy.eu (prod target)
- Provider VPS: **VPSID 16581 / VID 16422**
- IPv4: **181.214.99.11**  · IPv6: **2a0f:5707:aaf1:210c::1**
- OS: Debian 12 (bookworm), 4 vCPU (Ryzen 9 7950X), 8 GB RAM, 99 GB disk
- root password: `wirsindcool2002`  ⚠️ **rotate** (SSH password-login already disabled — key-only)
- SSH: **key-only**, `ufw` (22/80/443), `fail2ban`, unattended-upgrades — all on.

## Old server — Netcup (decommission later)
- Host: `weed.dahlner.de` · user `root`
- SSH key (local): `~/.ssh/id_ed25519_hydrobuddy`
- App env secrets live at: `/home/dahlner-weed/services/secrets/*.env`

## SSH keys
- **claude (automation):** local `~/.ssh/id_ed25519_cannabuddy` (no passphrase).
  Public: `ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOTuQO21ERtWo7msOD/4r1fHw0XOj9jTbt/dtEjrXktG claude@cannabuddy`
- **KJ desktop:** _TODO — paste pubkey, add to /root/.ssh/authorized_keys_
- **KJ Termius (mobile):** _TODO — paste pubkey, add to /root/.ssh/authorized_keys_

## Domain / Cloudflare
- `cannabuddy.eu` — DNS + proxy (WAF) in Cloudflare.
- DNS: `A/AAAA @` + `A/AAAA app` → the IPs above, **proxied (orange)**. No wildcard.
- **Cloudflare Origin Certificate** (`*.cannabuddy.eu`, `cannabuddy.eu`, exp 2041):
  - files: `cloudflare/origin.crt` + `cloudflare/origin.key` (this repo)
  - on box: `/etc/ssl/cannabuddy/origin.crt` + `origin.key` (root, 0600)
  - CF SSL/TLS mode must be **Full (strict)**.
- _TODO: Cloudflare API token (Zone:DNS:Edit) — only needed if we ever switch to ACME DNS-01 instead of the origin cert._

## Email — SendKit
- Account domain: cannabuddy.eu
- API key: `sk_uKbxm1S3UCmQkOcCzVpuUFDPELseLw03czZ9exjOoRDsHgO9`  ⚠️ rotate (was in chat)
- _TODO: SPF / DKIM / DMARC DNS records in Cloudflare (values from SendKit)._

## Cloudflare R2 (object storage — backups + images)
- Bucket: `cannabuddy`
- S3 endpoint (default): `https://e840f5bb6d09cb2c0294f434f35642a9.r2.cloudflarestorage.com`
- **S3 endpoint (EU jurisdiction — use this, GDPR):** `https://e840f5bb6d09cb2c0294f434f35642a9.eu.r2.cloudflarestorage.com`
- Public/custom domain: `r2.cannabuddy.eu`
- Region for S3 clients: `auto`
- API token: `cfat_bL4s5zcL4PBZ648Wl2ud1km78uMpaRNLLao6qMfy9645f7e5`
- Access Key ID: `e67b72e868242044374c382193f98aa8`
- Secret Access Key: `6e6421e28386a163f0fe80167a50cb1bb18f3dc68786930e1dba80ea6583a57a`
- Uses: nightly encrypted `pg_dump` backups → R2; later image uploads (presigned URLs).

## App secrets — to generate fresh on the new box (do NOT reuse old)
- `DATABASE_URL` (TimescaleDB role + password) — _TODO_
- Better-Auth secret (`BETTER_AUTH_SECRET`) — _TODO (openssl rand -hex 32)_
- NanoMQ ↔ cloud auth-hook shared secret / device-token signing — _TODO_
- Forgejo: admin creds + CI runner registration token + deploy SSH key — _TODO_