# vr1-dc1 creds manifest -- what MUST be consolidated in ~/vr1-dc1-creds/ (SEC-009 + D-126).
# scripts/creds-audit.sh verifies this list against the live folder: presence, mode,
# non-empty. No secret VALUES are read -- only existence, mode, and declared provenance.
#
# fields:  <filename>  <octal-mode>  <source>
#   source = "local"        -- generated/held on the jumphost (vcloud)
#          = "<vm>:<path>"   -- MINTED ON A SITE VM; a working copy MUST be pulled into
#                              the folder at mint time.
#
# STATUS: the ~/vr1-dc1-creds/ folder was pre-created (0700) as the landing target; the
# access keypair below is MINTED AT DC DEPLOY (generated on vcloud, pubkey -> vvr1-dc1
# cloud-init) per D-126 per-env-key isolation (a DEDICATED dc1 key, NOT office1's/dc0's).
# vr1-dc1*.env files (e.g. TF_VAR_* / MAAS) are ADDED to this manifest as the dc1 deploy
# design determines them -- not invented here (hard rule 2).

vr1-dc1_svc_ed25519         600  local
vr1-dc1_svc_ed25519.pub     644  local
# Edge service keypair (D-112(c) console bootstrap; minted 2026-07-22 on vcloud
# at the G12 dc1 edge-bootstrap step -- dc0 precedent, whose manifest rows are
# a queued backfill finding).
vr1-dc1-edge_ed25519        600  local
vr1-dc1-edge_ed25519.pub    644  local
# Edge REST API key/secret, minted on the edge via the vendor model
# (D-113(a2)); consolidated to vcloud 2026-07-22 at the G12 edge-address step.
opnsense-api.txt            600  local
# Dedicated MAAS->libvirt power key (SEC-016, per-DC isolation; minted
# 2026-07-23 at the G12 commissioning step). Private half also placed on
# voffice1's region MAAS snap (off-manifest -- the snap is not this folder).
vr1-dc1-maas-power_ed25519      600  local
vr1-dc1-maas-power_ed25519.pub  644  local