# vm-secret-locations -- the ABSOLUTE bound on credential discovery (D-137 ruling 3).
#
# RULING 3, 2026-07-26, operator utterance "Declared locations only": this list bounds
# `--remote` ABSOLUTELY. The sweep visits these locations and NOTHING else. It never walks
# a host looking for secrets, never expands beyond a listed path, and never touches a
# tenant surface -- D-069 (tenant credential custody stays off-repo) is preserved BY
# CONSTRUCTION rather than by the sweep's good behaviour.
#
# ADDING A ROW HERE IS DEFINITION-OF-DONE FOR ANY NEW MINT SITE. A location that is not
# listed is not audited, and an unaudited location is how SEC-022 happened.
#
# WHY EACH CLASS IS PRESENT (the ruling's faithful-implementation note):
# - per-site creds folders on the JUMPHOST -- the SEC-009 convention itself
# - per-site creds folders on the HEADEND -- SEC-022, the shadow stores that were
# structurally invisible: creds-audit resolves the folder against $HOME on whatever
# host it runs on and contains no ssh at all, so a headend-resident store could never
# be seen. D-128 puts Plane-2 execution on the headend, so these keep appearing.
# - the region secrets dir -- SEC-020, where admin.pass sat
# root-only for 12 days while the audit read CLEAN
# - the three dirs outside the SEC-009 convention (research FINDING 2)
# - the PKI overlay inside the repo clone -- a CA private key plus a plaintext
# passphrase, gitignored, in a repo SEC-004 records as currently PUBLIC
#
# ON THE TENANT DIRECTORIES, which look like a contradiction and are not: the per-tenant
# directories listed below are LOCAL operator-held copies on the jumphost. They are NOT a
# tenant surface. `ssh-target=local` is load-bearing -- no tenant VM, tenant project, or
# tenant-operated host is reachable from this file, and none may ever be added to it.
#
# FORMAT. Whitespace-separated: <host-role> <ssh-target> <path>
# host-role the role token used by creds-matrix.tsv (jumphost|headend|netbox|...)
# ssh-target `local` = the host this runs on (the jumphost), else an ssh alias from
# the D-126 ssh_config fragment (scripts/site-ssh-config.sh) -- these are
# MEASURED as-built aliases, never invented hostnames
# path an absolute path or a `~`-relative one, expanded on the TARGET host.
# A trailing `/*` means "the files directly in this directory".
# `#` comments and blank lines ignored. NO FIELD MAY CONTAIN WHITESPACE.
#
# A listed location that does not exist is NOT a failure -- it is reported as an explicit
# skip. Several of these belong to deployment stages this rehearsal has not reached.
# --- jumphost (vcloud): the SEC-009 convention -------------------------------
jumphost local ~/vr1-office1-creds/*
jumphost local ~/vr1-dc0-creds/*
jumphost local ~/vr1-dc1-creds/*
# --- jumphost: OUTSIDE the SEC-009 convention (research FINDING 2) -----------
# Named in CLAUDE.md as secret locations, so KNOWN -- simply outside the control until now.
jumphost local ~/vault-init/*
jumphost local ~/octavia-pki/*
jumphost local ~/tenant-*/*
# The PKI overlay lands INSIDE the repo clone (gitignored). `<repo>` is substituted at
# runtime from the checker's own location -- the repo has been renamed once already
# (D-110) and its name must never be hardcoded into a command or a data file.
jumphost local <repo>/overlays/octavia-pki.yaml
# DOCFIX-175: the Office1 MAAS API key reaches tfstate in PLAINTEXT. A secret-at-rest
# location with no mint of its own -- declared so the copy is audited, not just the mint.
jumphost local <repo>/opentofu/terraform.tfstate
# --- headend (voffice1): the SEC-022 shadow stores + the region secrets dir ---
# The region dir is root-owned; the sweep reads METADATA ONLY (existence, mode, digest)
# and never file content.
headend voffice1 ~/vr1-dc0-creds/*
headend voffice1 ~/vr1-dc1-creds/*
headend voffice1 /root/maas-secrets/*
# --- netbox VM: the founding SEC-009 miss ------------------------------------
netbox office1-netbox /root/netbox-secrets/*
