# vr1-office1 creds manifest -- what MUST be consolidated in ~/vr1-office1-creds/ (SEC-009).
# scripts/creds-audit.sh verifies this list against the live folder: presence, mode,
# non-empty. No secret VALUES are read -- only existence, mode, and declared provenance.
#
# fields:  <filename>  <octal-mode>  <source>
#   source = "local"        -- generated/held on the jumphost (vcloud)
#          = "<vm>:<path>"   -- MINTED ON A SITE VM; a working copy MUST be pulled into
#                              the folder at mint time (this is the class SEC-009 missed:
#                              office1-netbox:/root/netbox-secrets/api.token went
#                              un-consolidated until it was needed).
#
# MAAS region GUI/superuser passwords (SEC-020, 2026-07-25).
#   maas-admin-password -- the `admin` superuser's password, MINTED ON THE REGION VM
#     by scripts/site-headend-install.sh:452 (newpass -> 28 chars, alphanumeric, NO
#     trailing newline) and left root-only at /root/maas-secrets/admin.pass until this
#     consolidation. This is the SEC-009 miss class the NetBox token established: a
#     VM-minted secret with no forcing function to reach the folder. Byte-identical
#     copy (sha256-verified); the VM copy remains source-of-record, this is the working
#     copy. `admin` doubles as the automation identity (the `maas admin` CLI profile,
#     19 call sites), which is WHY nobody ever needed its password -- see SEC-020.
#   maas-operator-password -- the `operator` superuser, minted 2026-07-25 for HUMAN GUI
#     login so a person no longer has to authenticate as the service identity. 32-char
#     base64, generated on vcloud, set via stdin (never argv, per SEC-018 discipline).
# STILL UN-CONSOLIDATED on voffice1 (logged finding, NOT actioned -- hard rule 1):
#   /root/maas-secrets/{admin.apikey,db.pass,lxd-trust.pass}. admin.apikey is trivially
#   regenerable (`maas apikey --username=admin`) so it is deliberately NOT copied here;
#   db.pass + lxd-trust.pass are region infrastructure, out of scope of this task.
maas-admin-password         600  voffice1:/root/maas-secrets/admin.pass
maas-operator-password      600  local
# NetBox web-GUI `admin` password (SEC-025). CONSOLIDATED 2026-07-27: it was minted
# on the NetBox VM at stage 2 and had NEVER been pulled to the jumphost -- the SAME
# miss class as the api.token below (the founding SEC-009 defect) and as SEC-020's
# admin.pass, i.e. a VM-minted HUMAN GUI login with no forcing function to reach the
# folder. Found by the 2026-07-27 consolidation audit, which asked which accounts
# actually exist rather than which the register already knew about. Byte-identical
# copy, sha256-verified at both ends, 28 bytes; the VM copy REMAINS source-of-record,
# so any future rotation must update BOTH copies or this one becomes a stale trap
# (the caveat SEC-020 records for maas-admin-password applies identically here).
netbox-admin-password       600  office1-netbox:/root/netbox-secrets/admin.pass
office1_svc_ed25519         600  local
office1_svc_ed25519.pub     644  local
opnsense-api.txt            600  local
opnsense-root-hash          600  local
opnsense-root-password      600  local
README                      600  local
tailscale-authkey.txt       600  local
vr1-netbox.env              600  local
vr1-netbox-sandbox.env      600  office1-netbox:/root/netbox-secrets/api.token
vr1-office1.env             600  local
vr1-stage1.env              600  local