# vr1-dc0 creds manifest -- what MUST be consolidated in ~/vr1-dc0-creds/ (SEC-009 + D-126).
# scripts/creds-audit.sh verifies this list against the live folder: presence, mode,
# non-empty. No secret VALUES are read -- only existence, mode, and declared provenance.
#
# fields:  <filename>  <octal-mode>  <source>
#   source = "local"        -- generated/held on the jumphost (vcloud)
#          = "<vm>:<path>"   -- MINTED ON A SITE VM; a working copy MUST be pulled into
#                              the folder at mint time.
#
# STATUS: the access keypair below is MINTED (2026-07-16, on vcloud) -- generated EARLY (not at
# deploy) because vvr1-dc0's cloud-init reads the pubkey with file() at plan time (D-126 per-env-key
# option a: a DEDICATED dc0 key, NOT office1's). `creds-audit vr1-dc0` -> CLEAN.
# vr1-dc0*.env files (e.g. TF_VAR_* / MAAS) are ADDED to this manifest as the dc0 deploy
# design determines them -- not invented here (hard rule 2).

vr1-dc0_svc_ed25519         600  local
vr1-dc0_svc_ed25519.pub     644  local
# Edge service keypair (D-112(c) console bootstrap; minted on vcloud at the dc0
# edge-bootstrap step). BACKFILL 2026-07-25: these rows were the queued finding
# named in creds-manifests/vr1-dc1.manifest -- dc1 declared its equivalents at
# mint time, dc0's never were, so both showed as UNDECLARED creds-audit FAILs.
vr1-dc0-edge_ed25519        600  local
vr1-dc0-edge_ed25519.pub    644  local
# Dedicated dc0 MAAS admin API key for the Juju cloud credential (SEC-018;
# MAAS superuser juju-vr1-dc0). Generated FROM the jumphost 2026-07-24 so it
# never persisted on the region -- hence provenance "local", not a <vm>:<path>.
# A runtime copy also lives in Juju's client credential store on voffice1
# (off-manifest -- that store is not this folder). Declared 2026-07-25.
maas-api-key.txt            600  local