57 lines
3 KiB
Markdown
57 lines
3 KiB
Markdown
# CannaBuddy — secrets & access (PRIVATE)
|
|
|
|
**Keep this repo PRIVATE on Forgejo. Do NOT mirror into `cloud`/`docs`/`firmware`
|
|
(those are touched by CI + Seb).** Rotate anything that was pasted into a chat.
|
|
|
|
_Last updated: 2026-05-30 (new-VPS bring-up)._
|
|
|
|
---
|
|
|
|
## New server — cannabuddy.eu (prod target)
|
|
- Provider VPS: **VPSID 16581 / VID 16422**
|
|
- IPv4: **181.214.99.11** · IPv6: **2a0f:5707:aaf1:210c::1**
|
|
- OS: Debian 12 (bookworm), 4 vCPU (Ryzen 9 7950X), 8 GB RAM, 99 GB disk
|
|
- root password: `wirsindcool2002` ⚠️ **rotate** (SSH password-login already disabled — key-only)
|
|
- SSH: **key-only**, `ufw` (22/80/443), `fail2ban`, unattended-upgrades — all on.
|
|
|
|
## Old server — Netcup (decommission later)
|
|
- Host: `weed.dahlner.de` · user `root`
|
|
- SSH key (local): `~/.ssh/id_ed25519_hydrobuddy`
|
|
- App env secrets live at: `/home/dahlner-weed/services/secrets/*.env`
|
|
|
|
## SSH keys
|
|
- **claude (automation):** local `~/.ssh/id_ed25519_cannabuddy` (no passphrase).
|
|
Public: `ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOTuQO21ERtWo7msOD/4r1fHw0XOj9jTbt/dtEjrXktG claude@cannabuddy`
|
|
- **KJ desktop:** _TODO — paste pubkey, add to /root/.ssh/authorized_keys_
|
|
- **KJ Termius (mobile):** _TODO — paste pubkey, add to /root/.ssh/authorized_keys_
|
|
|
|
## Domain / Cloudflare
|
|
- `cannabuddy.eu` — DNS + proxy (WAF) in Cloudflare.
|
|
- DNS: `A/AAAA @` + `A/AAAA app` → the IPs above, **proxied (orange)**. No wildcard.
|
|
- **Cloudflare Origin Certificate** (`*.cannabuddy.eu`, `cannabuddy.eu`, exp 2041):
|
|
- files: `cloudflare/origin.crt` + `cloudflare/origin.key` (this repo)
|
|
- on box: `/etc/ssl/cannabuddy/origin.crt` + `origin.key` (root, 0600)
|
|
- CF SSL/TLS mode must be **Full (strict)**.
|
|
- _TODO: Cloudflare API token (Zone:DNS:Edit) — only needed if we ever switch to ACME DNS-01 instead of the origin cert._
|
|
|
|
## Email — SendKit
|
|
- Account domain: cannabuddy.eu
|
|
- API key: `sk_uKbxm1S3UCmQkOcCzVpuUFDPELseLw03czZ9exjOoRDsHgO9` ⚠️ rotate (was in chat)
|
|
- _TODO: SPF / DKIM / DMARC DNS records in Cloudflare (values from SendKit)._
|
|
|
|
## Cloudflare R2 (object storage — backups + images)
|
|
- Bucket: `cannabuddy`
|
|
- S3 endpoint (default): `https://e840f5bb6d09cb2c0294f434f35642a9.r2.cloudflarestorage.com`
|
|
- **S3 endpoint (EU jurisdiction — use this, GDPR):** `https://e840f5bb6d09cb2c0294f434f35642a9.eu.r2.cloudflarestorage.com`
|
|
- Public/custom domain: `r2.cannabuddy.eu`
|
|
- Region for S3 clients: `auto`
|
|
- API token: `cfat_bL4s5zcL4PBZ648Wl2ud1km78uMpaRNLLao6qMfy9645f7e5`
|
|
- Access Key ID: `e67b72e868242044374c382193f98aa8`
|
|
- Secret Access Key: `6e6421e28386a163f0fe80167a50cb1bb18f3dc68786930e1dba80ea6583a57a`
|
|
- Uses: nightly encrypted `pg_dump` backups → R2; later image uploads (presigned URLs).
|
|
|
|
## App secrets — to generate fresh on the new box (do NOT reuse old)
|
|
- `DATABASE_URL` (TimescaleDB role + password) — _TODO_
|
|
- Better-Auth secret (`BETTER_AUTH_SECRET`) — _TODO (openssl rand -hex 32)_
|
|
- NanoMQ ↔ cloud auth-hook shared secret / device-token signing — _TODO_
|
|
- Forgejo: admin creds + CI runner registration token + deploy SSH key — _TODO_
|