# vm-secret-locations -- the ABSOLUTE bound on credential discovery (D-137 ruling 3).
#
# RULING 3, 2026-07-26, operator utterance "Declared locations only": this list bounds
# `--remote` ABSOLUTELY. The sweep visits these locations and NOTHING else. It never walks
# a host looking for secrets, never expands beyond a listed path, and never touches a
# tenant surface -- D-069 (tenant credential custody stays off-repo) is preserved BY
# CONSTRUCTION rather than by the sweep's good behaviour.
#
# ADDING A ROW HERE IS DEFINITION-OF-DONE FOR ANY NEW MINT SITE. A location that is not
# listed is not audited, and an unaudited location is how SEC-022 happened.
#
# WHY EACH CLASS IS PRESENT (the ruling's faithful-implementation note):
# - per-site creds folders on the JUMPHOST -- the SEC-009 convention itself
# - per-site creds folders on the HEADEND -- SEC-022, the shadow stores that were
# structurally invisible: creds-audit resolves the folder against $HOME on whatever
# host it runs on and contains no ssh at all, so a headend-resident store could never
# be seen. D-128 puts Plane-2 execution on the headend, so these keep appearing.
# - the region secrets dir -- SEC-020, where admin.pass sat
# root-only for 12 days while the audit read CLEAN
# - the three dirs outside the SEC-009 convention (research FINDING 2)
# - the PKI overlay inside the repo clone -- a CA private key plus a plaintext
# passphrase, gitignored, in a repo SEC-004 records as currently PUBLIC
#
# ON THE TENANT DIRECTORIES, which look like a contradiction and are not: the per-tenant
# directories listed below are LOCAL operator-held copies on the jumphost. They are NOT a
# tenant surface. `ssh-target=local` is load-bearing -- no tenant VM, tenant project, or
# tenant-operated host is reachable from this file, and none may ever be added to it.
#
# FORMAT. Whitespace-separated: <host-role> <site-key> <ssh-target> <path>
# host-role the role token used by creds-matrix.tsv (jumphost|headend|netbox|...)
# site-key region-qualified site this location belongs to, or `-` if not site-scoped.
# ADDED 2026-07-26 (committee finding): without it the checker matched
# credentials on (role, basename) alone, so a file in ONE site's folder
# satisfied the row for EVERY site -- which masked SEC-021's dc0
# opnsense-api.txt absence. A per-DC credential must be resolved against its
# OWN site's location or the check is decorative.
# ssh-target `local` = the host this runs on (the jumphost), else an ssh alias from
# the D-126 ssh_config fragment (scripts/site-ssh-config.sh) -- these are
# MEASURED as-built aliases, never invented hostnames
# path an absolute path or a `~`-relative one, expanded on the TARGET host.
# A trailing `/*` means "the files directly in this directory".
# `#` comments and blank lines ignored. NO FIELD MAY CONTAIN WHITESPACE.
#
# A listed location that does not exist is NOT a failure -- it is reported as an explicit
# skip. Several of these belong to deployment stages this rehearsal has not reached.
# --- jumphost (vcloud): the SEC-009 convention -------------------------------
jumphost vr1-office1 local ~/vr1-office1-creds/*
jumphost vr1-dc0 local ~/vr1-dc0-creds/*
jumphost vr1-dc1 local ~/vr1-dc1-creds/*
# --- jumphost: OUTSIDE the SEC-009 convention (research FINDING 2) -----------
# Named in CLAUDE.md as secret locations, so KNOWN -- simply outside the control until now.
jumphost - local ~/vault-init/*
jumphost - local ~/octavia-pki/*
jumphost - local ~/tenant-*/*
# The PKI overlay lands INSIDE the repo clone (gitignored). `<repo>` is substituted at
# runtime from the checker's own location -- the repo has been renamed once already
# (D-110) and its name must never be hardcoded into a command or a data file.
jumphost - local <repo>/overlays/octavia-pki.yaml
# DOCFIX-175: the Office1 MAAS API key reaches tfstate in PLAINTEXT. A secret-at-rest
# location with no mint of its own -- declared so the copy is audited, not just the mint.
jumphost vr1-office1 local <repo>/opentofu/terraform.tfstate
# Committee finding: the tfstate SIBLINGS carry the same plaintext key and were unaudited.
jumphost vr1-office1 local <repo>/opentofu/terraform.tfstate.backup
jumphost vr1-office1 local <repo>/opentofu/terraform.tfstate.pre-*
# CLAUDE.md names ~/as-executed/ as credential material; it was missing from this list.
jumphost - local ~/as-executed/*
# The Octavia PKI artifacts are written into THREE SUBDIRECTORIES (phase-01:288), so the
# bare ~/octavia-pki/* pattern matched ZERO of the 8 artifacts incl. two CA private keys.
jumphost - local ~/octavia-pki/issuing-ca/*
jumphost - local ~/octavia-pki/controller-ca/*
jumphost - local ~/octavia-pki/controller/*
# Predicted Stage-5 exposure (SEC-023): phase-03 writes $HOME/admin-openrc.
jumphost - local ~/admin-openrc
# --- headend (voffice1): the SEC-022 shadow stores + the region secrets dir ---
# The region dir is root-owned; the sweep reads METADATA ONLY (existence, mode, digest)
# and never file content.
headend vr1-dc0 voffice1 ~/vr1-dc0-creds/*
headend vr1-dc1 voffice1 ~/vr1-dc1-creds/*
headend vr1-office1 voffice1 /root/maas-secrets/*
# MEASURED 2026-07-26: the CLI profile, the Juju client store, the MAAS snap ssh dir (which
# holds the per-DC power keys) and the rack-enrollment secret all live OUTSIDE the region
# secrets dir. Each was an inferred path in the first matrix draft; these are the real ones.
headend vr1-office1 voffice1 ~/snap/maas/current/.maascli.db
headend - voffice1 ~/.local/share/juju/*
headend - voffice1 /var/snap/maas/current/root/.ssh/*
headend vr1-office1 voffice1 /var/snap/maas/common/maas/secret
# --- netbox VM: the founding SEC-009 miss ------------------------------------
netbox vr1-office1 office1-netbox /root/netbox-secrets/*
