Initial skills documentation — 25 categories, all SKILL.md + references + scripts

2026-07-15 17:42:20 -04:00
commit 1b4fcd4427
976 changed files with 188344 additions and 0 deletions
@@ -0,0 +1,61 @@
+# Secret Management — Hermes Environment
+
+## Principle
+
+All secrets in one file: `~/.hermes/.env`, chmod 600, backed up in S3.
+Standalone token files (`.hetzner_token`, `.netcup_api_key`, etc.) are fragile — they get left behind during migration, broken during key rotation, and scripts that reference them fail silently when they're missing.
+
+## Current secret inventory
+
+| Secret | File location | Permissions | Notes |
+|---|---|---|---|
+| admin-ai API key | `~/.hermes/config.yaml` (2 places) | Root-readable | Also in `.env` as backup |
+| Telegram bot tokens | `~/.hermes/.env` | 600 | Default + Anita profiles |
+| Hetzner API token | `~/.hermes/.env` | 600 | Was standalone file |
+| Netcup API key | `~/.hermes/.env` | 600 | Was standalone file |
+| SMTP/IMAP passwords | `~/.config/himalaya/*.pass` | 600 | Himalaya standard |
+| Wasabi S3 keys | `~/.aws/credentials` | 600 | AWS CLI standard |
+| SSH keys | `~/.ssh/` | 600 | Standard |
+
+## Consolidation workflow
+
+When you discover a standalone secret file:
+
+1. Read it and the current `.env`:
+   ```
+   env_path = ~/.hermes/.env
+   standalone_path = ~/.hermes/scripts/.some_token
+   ```
+
+2. Load `.env` into a dict, add the new variable, write back:
+   ```
+   env_vars['HETZNER_API_TOKEN'] = token_value
+   ```
+
+3. `chmod 600 ~/.hermes/.env`
+
+4. Remove the standalone file:
+   ```bash
+   rm ~/.hermes/scripts/.some_token
+   ```
+
+5. Patch any scripts that referenced the old path to source from `.env`.
+
+## Reading secrets in scripts
+
+Scripts should source `.env` at the top:
+```bash
+set -a; source ~/.hermes/.env; set +a
+```
+
+Python scripts should use:
+```python
+import os
+from dotenv import load_dotenv
+load_dotenv(os.path.expanduser("~/.hermes/.env"))
+token = os.environ["HETZNER_API_TOKEN"]
+```
+
+## Special case: config.yaml inline keys
+
+The admin-ai API key lives in `config.yaml` in two places — `providers.admin-ai.api_key` and `auxiliary.vision.api_key`. Hermes reads these directly from the YAML config, not from env vars. The `.env` copy serves as a backup record for recovery. If the key rotates, update both config.yaml entries AND the `.env` backup.