# vr1-dc1 creds manifest -- what MUST be consolidated in ~/vr1-dc1-creds/ (SEC-009 + D-126).
# scripts/creds-audit.sh verifies this list against the live folder: presence, mode,
# non-empty. No secret VALUES are read -- only existence, mode, and declared provenance.
#
# fields:  <filename>  <octal-mode>  <source>
#   source = "local"        -- generated/held on the jumphost (vcloud)
#          = "<vm>:<path>"   -- MINTED ON A SITE VM; a working copy MUST be pulled into
#                              the folder at mint time.
#
# STATUS: the ~/vr1-dc1-creds/ folder was pre-created (0700) as the landing target; the
# access keypair below is MINTED AT DC DEPLOY (generated on vcloud, pubkey -> vvr1-dc1
# cloud-init) per D-126 per-env-key isolation (a DEDICATED dc1 key, NOT office1's/dc0's).
# vr1-dc1*.env files (e.g. TF_VAR_* / MAAS) are ADDED to this manifest as the dc1 deploy
# design determines them -- not invented here (hard rule 2).

vr1-dc1_svc_ed25519         600  local
vr1-dc1_svc_ed25519.pub     644  local