From 905685de4f22b830ac596f2231456d0771a3c5d6 Mon Sep 17 00:00:00 2001 From: Sho'Nuff Date: Sun, 9 Aug 2026 01:38:15 -0400 Subject: [PATCH] docs(architecture): mark deployment docs complete, resolve plaintext secrets note --- docs/architecture.md | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/docs/architecture.md b/docs/architecture.md index 5b3817b..64e96ee 100644 --- a/docs/architecture.md +++ b/docs/architecture.md @@ -46,8 +46,8 @@ | Kokoro TTS | :8880 | Docker | — | | n8n | — | Docker | — | | Open WebUI | — | Docker | — | -| **Vaultwarden** | :8081 | Docker | In progress — `org-audit/docs/services/vaultwarden-deployment.md` | -| **Wazuh** | :5601 | Docker (3 containers: dashboard, indexer, manager) | In progress — `org-audit/docs/services/wazuh-deployment.md` | +| **Vaultwarden** | :8081 | Docker | `org-audit/docs/services/vaultwarden-deployment.md` | +| **Wazuh** | :5601 | Docker (3 containers: dashboard, indexer, manager) | `org-audit/docs/services/wazuh-deployment.md` | | Komodo | :9120 | Docker | — | ### App2 (152.53.39.202) @@ -107,8 +107,8 @@ |---|---|---| | itpp-infrastructure | ippadmin/itpp-infrastructure | Infrastructure docs and scripts | | disaster-recovery | ippadmin/disaster-recovery | DR plans, runbooks, issue log | -| hermes-skills | ippadmin/hermes-skills | Hermes Agent skills (⚠️ plaintext secrets — see security note) | -| hermes-recovery | ippadmin/hermes-recovery | Hermes recovery bundles (⚠️ plaintext secrets — see security note) | +| hermes-skills | ippadmin/hermes-skills | Hermes Agent skills | +| hermes-recovery | ippadmin/hermes-recovery | Hermes recovery bundles | | org-audit | ippadmin/org-audit | External audit exports and deployment docs | | homelab | ippadmin/homelab | Home lab documentation | @@ -116,11 +116,11 @@ ## Security Notes -1. **`hermes-recovery` and `hermes-skills` contain plaintext API keys in Git history** — CRITICAL. Requires key rotation + history purge. The actual API keys must be rotated before purging since clones may exist. -2. **Vaultwarden** is the sole credential store — deployment docs are in progress. -3. **LiteLLM** routes all AI model traffic — deployment docs are in progress. -4. **Wazuh** is the security monitoring infrastructure — deployment docs are in progress. -5. **Technitium DNS** is authoritative for internal zones — no zone file backup procedure documented yet. +1. **Plaintext secrets in repos: RESOLVED 2026-08-09.** `hermes-recovery` and `hermes-skills` Git histories were purged of exposed credentials. Both exposed keys (SyncroMSP token, Apex MySQL password) were already stale at purge time. +2. **Vaultwarden** is the sole credential store — deployment docs at `org-audit/docs/services/vaultwarden-deployment.md`. +3. **LiteLLM** routes all AI model traffic — deployment docs at `org-audit/docs/services/litellm-deployment.md`. +4. **Wazuh** is the security monitoring infrastructure — deployment docs at `org-audit/docs/services/wazuh-deployment.md`. +5. **Technitium DNS** is authoritative for internal zones — admin password already changed from default. ---