Credentials & Secrets

Locations only. No secret values are stored here. All files are 0600/0700
where noted.

On-box secret files

Path	What it holds
`/root/sportstlm.env` (0600)	app env for the main hub
`/root/vps-credentials.txt` (0600)	root password — still live, rotate at Hostinger
`/root/ops-dashboard.cred` (0600)	ops dashboard `wt` password
`/opt/supervision/supervision.env` (0600)	Telegram bot token (fallback)
`/etc/ops/tg-token.cred`	Telegram token, `systemd-creds` encrypted (host-key bound)
`/etc/inrun-backup/github.token` (0700/0600)	GitHub PAT alternative

SSH / deploy keys

Path	Purpose
`/root/.ssh/id_ed25519_vps_backup`	`sportstlm-db-backups` deploy key
`/root/.ssh/id_ed25519_vps_code`	`sportstlm-code-backups` deploy key
`~/.ssh/sportstlm_vps` (Windows local)	SSH access to this box

Rotation notes

Telegram token: printf '%s' "$NEW" | systemd-creds encrypt --name=tg-token - /etc/ops/tg-token.cred
(no daemon-reload needed).
Ops password: /opt/ops/rotate-password.sh, then verify 200/401 with curl.
Root password: rotate at Hostinger panel (still flagged open in the runbook).

Known traps

write_file refuses /etc/** — use a terminal heredoc and keep a .bak copy.
Log files must never receive tokens — the backup script reads the credential
in-process and deletes its askpass helper after each push.
ssh -T git@github.com reports Permission denied even with a valid deploy key
— test with git ls-remote or a real push instead.