engine · this instance

What the instance is doing, and the one door a secret comes in by.

Rooms — encrypted groups this device is a member of.

People — invite colleagues, add one of your own devices, and confirm proposals.

Hand in a secret

Secrets enter here; the record only learns that they exist. The value goes straight into this instance's secret store as one file, readable by the engine user and nobody else. What lands on the record is that a secret of this name, for this component, was handed in by you — no value, and no digest of one. There is no way to read a secret back out: the daemon that owns it reads its own file at start, and that is all.

Replacing a secret is a new hand-in and the record keeps both. The one to be careful with is backup / password: restic cannot open a repository whose password has changed, so replacing it after the first snapshot locks every snapshot taken under the old one. Hand that one in once.

What this instance expects, one line each

backup / password — the restic encryption password. Generate it in Vaultwarden, save it there, paste it here. Once.
backup / repository — the storage-box line from suite's answer, shaped sftp:<sub-account>@<storage-box-host>:engine.
backup / sftp-bootstrap-password — the sub-account's password, generated in Vaultwarden and set in Robot. The host uses it once to install its own SSH key, then deletes it here.
backup / known-hosts — the storage box's ssh-ed25519 host-key line. Optional: the engine fetches and pins it itself once the repository is known.
deploy / hetzner-api-key — a team's Hetzner API key, the day the first beta instance is stamped out. Not before.
mail / smtp-password — the SMTP submission secret for sending invites, when mail arrives.

Component

Which component the secret is for. Lower case, digits and single hyphens; it is a directory name and never a path. A grant of secret-admin scoped to a component authorizes its secrets only; the owner's is unscoped.

Name

What the secret is called, e.g. repository, password, api-token. Same shape as the component.

Value

The secret itself. It is sent to steward and cleared from this form; it is never put in the address bar and never stored by this page.

Class

What the value is (rule 7). Almost everything here is secret; a component's own signing key is signing-key, and replacing one already in the store goes through the change ceremony, never a bare hand-in; a token somebody was handed out of band is personal; an endpoint that simply has no business in a repository is structural.