CannaBuddy — secrets & access (PRIVATE)

Keep this repo PRIVATE on Forgejo. Do NOT mirror into cloud/docs/firmware (those are touched by CI + Seb). Rotate anything that was pasted into a chat.

Last updated: 2026-05-30 (new-VPS bring-up).

New server — cannabuddy.eu (prod target)

Provider VPS: VPSID 16581 / VID 16422
IPv4: 181.214.99.11 · IPv6: 2a0f:5707:aaf1:210c::1
OS: Debian 12 (bookworm), 4 vCPU (Ryzen 9 7950X), 8 GB RAM, 99 GB disk
root password: wirsindcool2002 ⚠️ rotate (SSH password-login already disabled — key-only)
SSH: key-only, ufw (22/80/443), fail2ban, unattended-upgrades — all on.

Old server — Netcup (decommission later)

Host: weed.dahlner.de · user root
SSH key (local): ~/.ssh/id_ed25519_hydrobuddy
App env secrets live at: /home/dahlner-weed/services/secrets/*.env

SSH keys

claude (automation): local ~/.ssh/id_ed25519_cannabuddy (no passphrase). Public: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOTuQO21ERtWo7msOD/4r1fHw0XOj9jTbt/dtEjrXktG claude@cannabuddy
KJ desktop: TODO — paste pubkey, add to /root/.ssh/authorized_keys
KJ Termius (mobile): TODO — paste pubkey, add to /root/.ssh/authorized_keys

Domain / Cloudflare

cannabuddy.eu — DNS + proxy (WAF) in Cloudflare.
DNS: A/AAAA @ + A/AAAA app → the IPs above, proxied (orange). No wildcard.
Cloudflare Origin Certificate (*.cannabuddy.eu, cannabuddy.eu, exp 2041):
- files: cloudflare/origin.crt + cloudflare/origin.key (this repo)
- on box: /etc/ssl/cannabuddy/origin.crt + origin.key (root, 0600)
- CF SSL/TLS mode must be Full (strict).
TODO: Cloudflare API token (Zone:DNS:Edit) — only needed if we ever switch to ACME DNS-01 instead of the origin cert.

Email — SendKit

Account domain: cannabuddy.eu
API key: sk_uKbxm1S3UCmQkOcCzVpuUFDPELseLw03czZ9exjOoRDsHgO9 ⚠️ rotate (was in chat)
TODO: SPF / DKIM / DMARC DNS records in Cloudflare (values from SendKit).

Cloudflare R2 (object storage — backups + images)

Bucket: cannabuddy
S3 endpoint (default): https://e840f5bb6d09cb2c0294f434f35642a9.r2.cloudflarestorage.com
S3 endpoint (EU jurisdiction — use this, GDPR): https://e840f5bb6d09cb2c0294f434f35642a9.eu.r2.cloudflarestorage.com
Public/custom domain: r2.cannabuddy.eu
Region for S3 clients: auto
API token: cfat_bL4s5zcL4PBZ648Wl2ud1km78uMpaRNLLao6qMfy9645f7e5
Access Key ID: e67b72e868242044374c382193f98aa8
Secret Access Key: 6e6421e28386a163f0fe80167a50cb1bb18f3dc68786930e1dba80ea6583a57a
Uses: nightly encrypted pg_dump backups → R2; later image uploads (presigned URLs).

App secrets — to generate fresh on the new box (do NOT reuse old)

DATABASE_URL = postgres://hbcloud:095bb2ad7b25355592243d10c46e1e39cc15129cd71c5d53@127.0.0.1:5432/cannabuddy (also in /etc/cannabuddy/cloud.env on the box, root 0600; TimescaleDB 2.27.1 ext enabled)
Better-Auth secret (BETTER_AUTH_SECRET) — TODO (openssl rand -hex 32)
NanoMQ ↔ cloud auth-hook shared secret / device-token signing — TODO
Forgejo: admin creds + CI runner registration token + deploy SSH key — TODO

3.2 KiB Raw Blame History