Infrastructure
Secrets
Secret inventory, storage locations, and rotation policy — no values.
Secrets
This page inventories credentials and secrets by name only. Never commit secret values to Git or documentation.
Policy
| Rule | Detail |
|---|---|
| Git | Secrets must never enter the repository |
| Documentation | Document names, consumers, and storage — never values |
| Scope | Minimum required permissions for each credential |
| Rotation | Rotate at provider/UI level; update Dokploy env or host files |
Storage models
| Model | Used for | Example |
|---|---|---|
| Dokploy environment variables | Application runtime secrets | DATABASE_URL, SENTRY_DSN |
| Host filesystem (restricted permissions) | Infrastructure secrets Traefik reads | Cloudflare DNS API token |
Local .env (git-ignored) | Developer workstation only | Local Postgres password |
Secret inventory
| Secret / credential | Consumer | Storage location | Scope / permissions | Repository policy | Status |
|---|---|---|---|---|---|
DATABASE_URL | API | Dokploy env (staging) | Internal PostgreSQL access | .env.example shows format only; never real staging creds | Active (staging) |
| Cloudflare DNS API token | Traefik (letsencrypt-cloudflare) | Host: /etc/dokploy/traefik/secrets/cloudflare-dns-api-token | Zone Read + DNS Edit on getbytebite.co only | Never in Git | Active (staging) |
SENTRY_DSN | API (via @bytebite/observability) | Dokploy env | Project-specific DSN | Optional locally; placeholder in .env.example | Configured (optional) |
BETTER_AUTH_SECRET | API / auth (future) | Dokploy env (planned) | Auth signing | Placeholder in .env.example | Not wired |
STRIPE_SECRET_KEY | API (future) | Dokploy env (planned) | Stripe API | Empty placeholders in .env.example | Not implemented |
STRIPE_PUBLISHABLE_KEY | Storefront (future) | Build-time env (planned) | Public key | Empty placeholder | Not implemented |
STRIPE_WEBHOOK_SECRET | API (future) | Dokploy env (planned) | Webhook verification | Empty placeholder | Not implemented |
AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY | API (SES, future) | Dokploy env (planned) | SES send permissions | Empty placeholders | Not implemented |
SES_FROM_EMAIL | API (future) | Dokploy env (planned) | Verified sender | Empty placeholder | Not implemented |
TWILIO_ACCOUNT_SID / TWILIO_AUTH_TOKEN | API (future) | Dokploy env (planned) | SMS send | Empty placeholders | Not implemented |
TWILIO_MESSAGING_SERVICE_SID | API (future) | Dokploy env (planned) | Messaging service | Empty placeholder | Not implemented |
S3_ACCESS_KEY_ID / S3_SECRET_ACCESS_KEY | API | Local .env (MinIO defaults) | S3 bucket access | Dev placeholders only | Local dev only |
MAPBOX_ACCESS_TOKEN | API (future) | Dokploy env (planned) | Geocoding | Empty placeholder | Not implemented |
| ACME account keys | Traefik | acme.json, acme-cloudflare.json | Let's Encrypt account | Host filesystem only | Active |
| Dokploy admin credentials | Dokploy UI | Dokploy internal | Full deployment access | Not in repository | Active |
| SSH keys | Server access | Operator workstations | Server administration | Not in repository | Active |
Cloudflare DNS API token
| Attribute | Value |
|---|---|
| File | /etc/dokploy/traefik/secrets/cloudflare-dns-api-token |
| Permissions | 600, root:root |
| Container mount | /run/secrets/cloudflare-dns-api-token via CF_DNS_API_TOKEN_FILE |
| Required scopes | Zone Read + DNS Edit on getbytebite.co |
| Optional hardening | Source IP restriction to 88.99.0.118/32 |
The token value must never appear in documentation.
Rotation (conceptual)
- Generate new credential at the provider (Cloudflare, Stripe, etc.).
- Update Dokploy environment or host filesystem file.
- Restart affected services (API containers for app secrets;
dokploy-traefikfor DNS token). - Verify with Validation smoke tests.
- Revoke old credential at provider.
For Traefik DNS token rotation, also verify wildcard TLS issuance after restart.
Related
- TLS — Cloudflare token usage
- Security — trust boundaries
- Operations — rotation procedures
.env.example— local placeholder names (no real secrets)