# vr1-office1 creds manifest -- what MUST be consolidated in ~/vr1-office1-creds/ (SEC-009).
# scripts/creds-audit.sh verifies this list against the live folder: presence, mode,
# non-empty. No secret VALUES are read -- only existence, mode, and declared provenance.
#
# fields:  <filename>  <octal-mode>  <source>
#   source = "local"        -- generated/held on the jumphost (vcloud)
#          = "<vm>:<path>"   -- MINTED ON A SITE VM; a working copy MUST be pulled into
#                              the folder at mint time (this is the class SEC-009 missed:
#                              office1-netbox:/root/netbox-secrets/api.token went
#                              un-consolidated until it was needed).
#
# MAAS region GUI/superuser passwords (SEC-020, 2026-07-25).
#   maas-admin-password -- the `admin` superuser's password, MINTED ON THE REGION VM
#     by scripts/site-headend-install.sh:452 (newpass -> 28 chars, alphanumeric, NO
#     trailing newline) and left root-only at /root/maas-secrets/admin.pass until this
#     consolidation. This is the SEC-009 miss class the NetBox token established: a
#     VM-minted secret with no forcing function to reach the folder. Byte-identical
#     copy (sha256-verified); the VM copy remains source-of-record, this is the working
#     copy. `admin` doubles as the automation identity (the `maas admin` CLI profile,
#     19 call sites), which is WHY nobody ever needed its password -- see SEC-020.
#   maas-operator-password -- the `operator` superuser, minted 2026-07-25 for HUMAN GUI
#     login so a person no longer has to authenticate as the service identity. 32-char
#     base64, generated on vcloud, set via stdin (never argv, per SEC-018 discipline).
# STILL UN-CONSOLIDATED on voffice1 (logged finding, NOT actioned -- hard rule 1):
#   /root/maas-secrets/{admin.apikey,db.pass,lxd-trust.pass}. admin.apikey is trivially
#   regenerable (`maas apikey --username=admin`) so it is deliberately NOT copied here;
#   db.pass + lxd-trust.pass are region infrastructure, out of scope of this task.
maas-admin-password         600  voffice1:/root/maas-secrets/admin.pass
maas-operator-password      600  local
office1_svc_ed25519         600  local
office1_svc_ed25519.pub     644  local
opnsense-api.txt            600  local
opnsense-root-hash          600  local
opnsense-root-password      600  local
README                      600  local
tailscale-authkey.txt       600  local
vr1-netbox.env              600  local
vr1-netbox-sandbox.env      600  office1-netbox:/root/netbox-secrets/api.token
vr1-office1.env             600  local
vr1-stage1.env              600  local