CannaBuddy — secrets & access (PRIVATE)

Keep this repo PRIVATE on Forgejo. Do NOT mirror into cloud/docs/firmware (those are touched by CI + Seb). Rotate anything that was pasted into a chat.

Last updated: 2026-05-30 (new-VPS bring-up).

New server — cannabuddy.eu (prod target)

Provider VPS: VPSID 16581 / VID 16422
IPv4: 181.214.99.11 · IPv6: 2a0f:5707:aaf1:210c::1
OS: Debian 12 (bookworm), 4 vCPU (Ryzen 9 7950X), 8 GB RAM, 99 GB disk
root password: wirsindcool2002 ⚠️ rotate (SSH password-login already disabled — key-only)
SSH: key-only, ufw (22/80/443), fail2ban, unattended-upgrades — all on.

Old server — Netcup (decommission later)

Host: weed.dahlner.de · user root
SSH key (local): ~/.ssh/id_ed25519_hydrobuddy
App env secrets live at: /home/dahlner-weed/services/secrets/*.env

SSH keys

claude (automation): local ~/.ssh/id_ed25519_cannabuddy (no passphrase). Public: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOTuQO21ERtWo7msOD/4r1fHw0XOj9jTbt/dtEjrXktG claude@cannabuddy
KJ desktop: TODO — paste pubkey, add to /root/.ssh/authorized_keys
KJ Termius (mobile): TODO — paste pubkey, add to /root/.ssh/authorized_keys

Domain / Cloudflare

cannabuddy.eu — DNS + proxy (WAF) in Cloudflare.
DNS: A/AAAA @ + A/AAAA app → the IPs above, proxied (orange). No wildcard.
Cloudflare Origin Certificate (*.cannabuddy.eu, cannabuddy.eu, exp 2041):
- files: cloudflare/origin.crt + cloudflare/origin.key (this repo)
- on box: /etc/ssl/cannabuddy/origin.crt + origin.key (root, 0600)
- CF SSL/TLS mode must be Full (strict).
TODO: Cloudflare API token (Zone:DNS:Edit) — only needed if we ever switch to ACME DNS-01 instead of the origin cert.

Email — SendKit

Account domain: cannabuddy.eu
API key: sk_uKbxm1S3UCmQkOcCzVpuUFDPELseLw03czZ9exjOoRDsHgO9 ⚠️ rotate (was in chat)
TODO: SPF / DKIM / DMARC DNS records in Cloudflare (values from SendKit).

App secrets — to generate fresh on the new box (do NOT reuse old)

DATABASE_URL (TimescaleDB role + password) — TODO
Better-Auth secret (BETTER_AUTH_SECRET) — TODO (openssl rand -hex 32)
NanoMQ ↔ cloud auth-hook shared secret / device-token signing — TODO
Forgejo: admin creds + CI runner registration token + deploy SSH key — TODO

2.4 KiB Raw Blame History