refactor(credentials): address them at secrets.credentials, like every other meta file

meta/schema.yml became meta/secrets.yml, but its content still landed at
applications.<app>.credentials — the one meta file whose payload did not sit
under a root named after the file. Every other topic obeys that rule:
meta/volumes.yml goes to volumes, meta/rbac.yml to rbac. Credentials now go to
secrets.credentials.

The path exists exactly once, in utils/manager/credential_key.py, and
OVERRIDE_SECTION is derived from its two segments rather than spelled beside
them, so the dotted form used by --set and the nested form used by the
inventory cannot drift. Six consumers read it: the loader, the generator, the
CLI override parser, the two emit helpers, and the four lookup validators.

--set now accepts exactly one key shape,
applications.<app>.secrets.credentials.<key>. The three short forms are
rejected instead of guessed at: the same short key names different credentials
on different apps. That also retired primary_app_id, which only existed to
disambiguate them.

Three defects surfaced while wiring this up. _apply_one_role_schema still wrote
to the old root, so an app's own credentials would have moved while its
providers' stayed behind. web-app-pgadmin reads through
lookup('applications', ...).credentials.<key>, an access path no regex over
lookup('config', ...) could see, and would have deployed with an empty postgres
password. And _META_NON_GENERIC_TOPICS still listed 'schema' — a bare topic
name, invisible to any path search — so the generic file-root loop assigned the
raw schema under secrets and the follow-up write landed inside the cached
document, truncating keycloak's four credentials to one for every later
reader.

tests/integration/ansible/lookups/config/test_credentials_roundtrip.py pins both
directions of the seam and the cache invariant that last defect broke.

Existing inventories still carry the pre-rename root; migrating them is
deliberately out of scope here.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

cli/administration/inventory/credentials/__main__.py

@@ -9,7 +9,7 @@ Usage example::
       --role-path roles/web-app-akaunting \\
       --inventory-file host_vars/echoserver.yml \\
       --vault-password-file .pass/echoserver.txt \\
-      --set credentials.database_password=mysecret
+      --set secrets.credentials.database_password=mysecret
 
 Snippet mode (no file changes, YAML printed to stdout)::
 
@@ -30,8 +30,13 @@ from ruamel.yaml.comments import CommentedMap
 
 from utils.manager.inventory import InventoryManager
 
-from .emit import emit_credentials, ensure_map
-from .overrides import parse_overrides
+from .emit import (
+    credentials_map,
+    declared_credentials,
+    emit_credentials,
+    ensure_map,
+)
+from .overrides import parse_overrides, split_override_key
 from .prompts import ask_for_confirmation
 from .vault import to_vault_block
 
@@ -131,17 +136,16 @@ def _run_snippet_mode(
     for app_id, app_block in schema_apps.items():
         if not isinstance(app_block, dict):
             continue
-        schema_creds = app_block.get("credentials", {})
+        schema_creds = declared_credentials(app_block)
         if not isinstance(schema_creds, dict) or not schema_creds:
             continue
 
         app_block_snip = ensure_map(apps_snip, app_id)
-        creds_snip = ensure_map(app_block_snip, "credentials")
+        creds_snip = credentials_map(app_block_snip)
         emit_credentials(
             schema_creds,
             creds_snip,
             app_id=app_id,
-            primary_app_id=manager.app_id,
             key_path="",
             overrides=overrides,
             vault_handler=manager.vault_handler,
@@ -178,18 +182,17 @@ def _run_default_mode(
     for app_id, app_block_schema in schema_apps.items():
         if not isinstance(app_block_schema, dict):
             continue
-        schema_creds = app_block_schema.get("credentials", {})
+        schema_creds = declared_credentials(app_block_schema)
         if not isinstance(schema_creds, dict) or not schema_creds:
             continue
 
         app_block = ensure_map(apps, app_id)
-        creds = ensure_map(app_block, "credentials")
+        creds = credentials_map(app_block)
         added = newly_added_keys.setdefault(app_id, set())
         emit_credentials(
             schema_creds,
             creds,
             app_id=app_id,
-            primary_app_id=manager.app_id,
             key_path="",
             overrides=overrides,
             vault_handler=manager.vault_handler,
@@ -235,27 +238,17 @@ def _apply_force_overrides(
     inventory. Only fires under ``--force``; freshly-added keys are
     skipped because they were already populated from the same override."""
     for ov_key, ov_val in overrides.items():
-        if ov_key.startswith("applications.") and ".credentials." in ov_key:
-            rest = ov_key[len("applications.") :]
-            app_id, tail = rest.split(".credentials.", 1)
-            key = tail
-        elif ".credentials." in ov_key:
-            app_id, key = ov_key.split(".credentials.", 1)
-        else:
-            app_id = manager.app_id
-            key = (
-                ov_key.split(".", 1)[1] if ov_key.startswith("credentials.") else ov_key
-            )
+        app_id, key = split_override_key(ov_key)
 
         if app_id not in apps:
             continue
         app_block = ensure_map(apps, app_id)
-        creds = ensure_map(app_block, "credentials")
+        creds = credentials_map(app_block)
 
         if key in creds:
             if key in newly_added_keys.get(app_id, set()):
                 continue
-            if args.yes or ask_for_confirmation(f"{app_id}.credentials.{key}"):
+            if args.yes or ask_for_confirmation(f"{app_id}.secrets.credentials.{key}"):
                 creds[key] = to_vault_block(manager.vault_handler, ov_val, key)
 
 

cli/administration/inventory/credentials/emit.py

@@ -6,6 +6,8 @@ from typing import TYPE_CHECKING, Any
 
 from ruamel.yaml.comments import CommentedMap
 
+from utils.manager.credential_key import CREDENTIALS_KEY, SECRETS_KEY
+
 from .overrides import override_for
 from .vault import is_vault_encrypted, to_vault_block
 
@@ -21,12 +23,30 @@ def ensure_map(node: CommentedMap, key: str) -> CommentedMap:
     return node[key]
 
 
+def credentials_map(app_block: CommentedMap) -> CommentedMap:
+    """The writable ``secrets.credentials`` node of one application block.
+
+    Args:
+        app_block: the ``applications.<app_id>`` map.
+    """
+    return ensure_map(ensure_map(app_block, SECRETS_KEY), CREDENTIALS_KEY)
+
+
+def declared_credentials(app_block: dict) -> dict:
+    """The credentials an application block declares, empty when it declares
+    none. Reading a malformed ``secrets`` raises rather than resolving empty.
+
+    Args:
+        app_block: the ``applications.<app_id>`` map.
+    """
+    return app_block.get(SECRETS_KEY, {}).get(CREDENTIALS_KEY, {})
+
+
 def emit_credentials(
     schema_node: dict,
     dest_node: CommentedMap,
     *,
     app_id: str,
-    primary_app_id: str,
     key_path: str,
     overrides: dict[str, str],
     vault_handler: VaultHandler,
@@ -35,12 +55,11 @@ def emit_credentials(
 ) -> None:
     """Walk a (possibly nested) credentials schema and emit one vault
     block per scalar leaf into ``dest_node``. Nested dicts (e.g.
-    ``credentials.recaptcha = {key, secret}``) recurse into nested
+    ``secrets.credentials.recaptcha = {key, secret}``) recurse into nested
     CommentedMaps so each leaf becomes its own vault-encrypted entry
     instead of being collapsed via ``str(dict)`` into a Python-repr
     blob (the regression that broke run 26428080957 jobs 77797371397
     and 77797371442 for web-app-espocrm and web-app-listmonk)."""
-    is_primary = app_id == primary_app_id
     for key, default_val in schema_node.items():
         full_key = f"{key_path}.{key}" if key_path else key
 
@@ -50,7 +69,6 @@ def emit_credentials(
                 default_val,
                 sub,
                 app_id=app_id,
-                primary_app_id=primary_app_id,
                 key_path=full_key,
                 overrides=overrides,
                 vault_handler=vault_handler,
@@ -62,7 +80,7 @@ def emit_credentials(
         if skip_existing and key in dest_node:
             continue
 
-        ov = override_for(app_id, full_key, overrides, is_primary=is_primary)
+        ov = override_for(app_id, full_key, overrides)
         value_for_key: str | Any = ov if ov is not None else default_val
 
         if is_vault_encrypted(value_for_key):

cli/administration/inventory/credentials/overrides.py

@@ -2,40 +2,47 @@
 
 from __future__ import annotations
 
+from utils.manager.credential_key import (
+    OVERRIDE_ROOT,
+    OVERRIDE_SECTION,
+    override_key,
+    split_override_key,
+)
+
+__all__ = ["override_for", "override_key", "parse_overrides", "split_override_key"]
+
 
 def parse_overrides(pairs: list[str]) -> dict[str, str]:
-    """Parse ``--set key=value`` pairs into a dict. Supports both
-    ``credentials.key=val`` and ``key=val`` (short) forms."""
+    """Parse ``--set <key>=<value>`` pairs into a dict.
+
+    Args:
+        pairs: raw ``key=value`` strings from the command line.
+
+    Every key MUST be the fully qualified form :func:`override_key` builds; a
+    short form is rejected rather than guessed at, because the same short key
+    names different credentials on different apps.
+    """
     out: dict[str, str] = {}
+    prefix = f"{OVERRIDE_ROOT}."
+    section = f".{OVERRIDE_SECTION}."
     for pair in pairs:
-        k, v = pair.split("=", 1)
-        out[k.strip()] = v.strip()
+        raw_key, value = pair.split("=", 1)
+        key = raw_key.strip()
+        if not key.startswith(prefix) or section not in key:
+            raise SystemExit(
+                f"--set {key}: expected "
+                f"{OVERRIDE_ROOT}.<app_id>.{OVERRIDE_SECTION}.<key>=<value>"
+            )
+        out[key] = value.strip()
     return out
 
 
-def override_for(
-    app_id: str, key: str, overrides: dict[str, str], *, is_primary: bool
-) -> str | None:
-    """Resolve overrides for a credential key.
+def override_for(app_id: str, key: str, overrides: dict[str, str]) -> str | None:
+    """The override value for one credential, or None when unset.
 
-    Supported forms:
-      - ``applications.<app_id>.credentials.<key>=...``
-      - ``<app_id>.credentials.<key>=...``
-    Backwards compatible (PRIMARY app only):
-      - ``credentials.<key>=...``
-      - ``<key>=...``
+    Args:
+        app_id: application the credential belongs to.
+        key: dotted path inside the schema's ``credentials`` node.
+        overrides: parsed ``--set`` pairs.
     """
-    v = overrides.get(f"applications.{app_id}.credentials.{key}")
-    if v is not None:
-        return v
-    v = overrides.get(f"{app_id}.credentials.{key}")
-    if v is not None:
-        return v
-    if is_primary:
-        v = overrides.get(f"credentials.{key}")
-        if v is not None:
-            return v
-        v = overrides.get(key)
-        if v is not None:
-            return v
-    return None
+    return overrides.get(override_key(app_id, key))

docs/contributing/design/role/services/layout.md

@@ -42,7 +42,11 @@ The paths are:
 | `meta/volumes.yml.<key>`              | `volumes.<key>`                                  |
 | `meta/services.yml.<primary_entity>.<top-level-key>.<…>` | `services.<primary_entity>.<top-level-key>.<…>` |
 
-`credentials.*` paths are populated by `apply_schema()` at `applications.<app>.credentials.<…>`.
+| `meta/secrets.yml.credentials.<key>`  | `secrets.credentials.<key>`                      |
+
+`secrets.credentials.*` paths are populated by `apply_schema()` at
+`applications.<app>.secrets.credentials.<…>`, so the credential file obeys the
+same file-root rule as every other `meta/<topic>.yml`.
 
 ## Services Inlining Rule 📥
 
@@ -344,10 +348,10 @@ config: {}                  # optional, opaque, role-interpreted runtime payload
 | `version` | no | string | `""` | A pin MUST be a quoted string, never an unquoted number. `""` tracks the app default. |
 | `group` | no | string | — | Free grouping label (e.g. Odoo `core`/`optional`). MUST NOT affect enablement. |
 | `update` | no | map | — | `monitored` (bool, default `false`), `catalog` (a supported adapter), `upstream_id` (defaults to the addon id). |
-| `config` | no | map | — | Opaque, role-interpreted runtime payload. Lint does not constrain its inner shape beyond requiring a mapping. Secrets inside `config` MUST resolve through `lookup('config', application_id, 'credentials.<name>')` and MUST NOT be inlined literally. |
+| `config` | no | map | — | Opaque, role-interpreted runtime payload. Lint does not constrain its inner shape beyond requiring a mapping. Secrets inside `config` MUST resolve through `lookup('config', application_id, 'secrets.credentials.<name>')` and MUST NOT be inlined literally. |
 
 Any credential an addon needs is declared in `meta/secrets.yml` `credentials:`
-and read via `lookup('config', application_id, 'credentials.<name>')`. There
+and read via `lookup('config', application_id, 'secrets.credentials.<name>')`. There
 is no new secret store.
 
 ### Bridges: in-repo dependency vs network bridge

docs/requirements/025-mcp-role-integration.md

@@ -24,7 +24,7 @@ These choices are settled at requirement creation time and bound the implementat
 
 1. **Implementation precedence.** `native` > `plugin` > `sidecar` > `external`. A lower-precedence path is allowed only when the higher one is unavailable upstream and the role README documents why.
 2. **Discovery reuses existing infrastructure.** Client roles discover servers through the existing [`roles_with_service`](../../plugins/lookup/roles_with_service.py) lookup (backed by `utils.cache.applications.get_merged_applications`), extended to filter by `services.mcp.direction` and to surface endpoint metadata. No new generated repository-wide application dictionary is introduced.
-3. **Secrets reuse the credentials mechanism.** MCP tokens, app-passwords, and OAuth client secrets are declared in each role's [`meta/secrets.yml`](../../roles/web-app-baserow/meta/secrets.yml) `credentials:` block and read via `lookup('config', application_id, 'credentials.<name>')`. No new secret store is introduced.
+3. **Secrets reuse the credentials mechanism.** MCP tokens, app-passwords, and OAuth client secrets are declared in each role's [`meta/secrets.yml`](../../roles/web-app-baserow/meta/secrets.yml) `credentials:` block and read via `lookup('config', application_id, 'secrets.credentials.<name>')`. No new secret store is introduced.
 4. **MCP state is a variant axis.** Roles that gain an MCP surface MUST express the enabled/disabled split through `meta/variants.yml` so CI matrix runs cover both states.
 5. **Lint reuses the suppression model.** New MCP lint rules live under [`tests/lint/ansible/services/`](../../tests/lint/ansible/services/) and honour the existing `# nocheck:` marker convention (see [suppression docs](../contributing/actions/testing/suppression.md)).
 6. **First slice.** The first end-to-end slice is `web-app-baserow` (server) plus `web-app-openwebui` (client).
@@ -165,7 +165,7 @@ The lookup MUST remain backed by `utils.cache.applications.get_merged_applicatio
 
 - [ ] No deployed role launches arbitrary user-provided stdio MCP commands by default.
 - [ ] Every MCP server endpoint is protected by OIDC, app-password, bearer-token, upstream-session auth, or an explicitly documented internal-only exception.
-- [ ] MCP credentials (tokens, app-passwords, OAuth client secrets) are declared in the role's [`meta/secrets.yml`](../../roles/web-app-baserow/meta/secrets.yml) `credentials:` block and consumed via `lookup('config', application_id, 'credentials.<name>')`; they are never written into `README.md`, Playwright traces, or non-secret env vars.
+- [ ] MCP credentials (tokens, app-passwords, OAuth client secrets) are declared in the role's [`meta/secrets.yml`](../../roles/web-app-baserow/meta/secrets.yml) `credentials:` block and consumed via `lookup('config', application_id, 'secrets.credentials.<name>')`; they are never written into `README.md`, Playwright traces, or non-secret env vars.
 - [ ] Every MCP server role documents whether MCP calls execute as the requesting user, a service account, or an administrator, and the implementation enforces that subject consistently.
 - [ ] Client roles MUST NOT register service-account or administrator-scoped MCP servers as globally enabled default tools unless the server advertises read-only tools only.
 - [ ] Public MCP exposure includes proxy routing, TLS, request-size limits, timeout limits, and rate-limit guidance.

docs/requirements/026-unified-addon-syntax.md

@@ -28,8 +28,8 @@ These choices are settled at requirement creation time and bound the implementat
 1. **One file per addon.** Addon definitions live under `roles/<role>/meta/addons/`, one file per addon at `meta/addons/<addon_id>.yml`. The file-root convention applies per file: the file content IS the addon spec, with no wrapping `<addon_id>:` key (the filename stem supplies the addon id); all files are collected into `applications.<role_id>.addons` keyed by `<addon_id>` (see [layout.md](../contributing/design/role/services/layout.md)). The materialised path is `applications.<role_id>.addons.<addon_id>`, read via `lookup('config', application_id, 'addons.<addon_id>')`.
 2. **Unified schema, native mechanism preserved.** Every addon entry uses one schema across all roles. The app-native term is retained only as the `mechanism` field (`addon`, `plugin`, `mu_plugin`, `extension`, `module`, `bridge`). Tasks keep using the upstream installer for that mechanism; only the *declaration* is unified. App-specific runtime configuration is carried under an opaque `config:` mapping that only the owning role's tasks interpret, so the surrounding schema stays uniform while each addon keeps its full per-addon payload. Each `meta/addons/<addon_id>.yml` is therefore the single source for both the declaration and the runtime config: where a role previously split the enable/disable declaration from a per-addon config payload (e.g. Nextcloud's `vars/plugins/`), both move into that addon's `meta/addons/<addon_id>.yml` file and the superseded per-addon config files are deleted by the migration.
 3. **Bridges are explicit and validated.** When an addon itself integrates with another role, it MUST list the bridged service key under `bridges:`. Each listed key MUST resolve to a service block already declared in the same role's `meta/services.yml`. Lint fails otherwise. Front-door auth gates such as oauth2-proxy are not addon bridges unless the addon itself talks to that service. **Two distinct meanings of "bridge" exist and MUST NOT be conflated:** the `bridges:` *field* names an in-repo cross-role service dependency (e.g. an addon that talks to `svc-db-openldap`), whereas `mechanism: bridge` marks an addon that *is* a network/appservice bridge to an external system (e.g. a Matrix mautrix bridge to WhatsApp/Telegram). A single addon MAY be both: a `mechanism: bridge` addon MAY also declare a `bridges:` dependency on an in-repo service it relies on.
-4. **No new secret store.** Any credential an addon needs continues to be declared in [`meta/secrets.yml`](../contributing/design/role/services/layout.md) `credentials:` and read via `lookup('config', application_id, 'credentials.<name>')`.
-5. **Enable state defaults to off; deliberately-wired integrations auto-enable with their partner.** `enabled` is optional and defaults to `false` unless `required: true` is set. An addon that bridges a service MUST derive its effective enablement from that service's `enabled` flag (never a duplicated group-membership expression), so a deliberately-wired cross-role integration activates automatically whenever its partner role is co-deployed (`services.<target>.enabled` is true) and stays off otherwise. Any credential an addon needs is declared in `meta/secrets.yml` `credentials:` and read via `lookup('config', application_id, 'credentials.<name>')` (Decision 4): auto-generated where possible, or supplied through the same credentials mechanism's manual-entry path where the operator must enter the secret. There is no separate opt-in exception: auto-enable-with-partner holds, and an operator-entered credential resolves through `credentials` like any other. This auto-enable-with-partner rule is distinct from update-automation-discovered addons (Decision 10), which are added hard-off.
+4. **No new secret store.** Any credential an addon needs continues to be declared in [`meta/secrets.yml`](../contributing/design/role/services/layout.md) `credentials:` and read via `lookup('config', application_id, 'secrets.credentials.<name>')`.
+5. **Enable state defaults to off; deliberately-wired integrations auto-enable with their partner.** `enabled` is optional and defaults to `false` unless `required: true` is set. An addon that bridges a service MUST derive its effective enablement from that service's `enabled` flag (never a duplicated group-membership expression), so a deliberately-wired cross-role integration activates automatically whenever its partner role is co-deployed (`services.<target>.enabled` is true) and stays off otherwise. Any credential an addon needs is declared in `meta/secrets.yml` `credentials:` and read via `lookup('config', application_id, 'secrets.credentials.<name>')` (Decision 4): auto-generated where possible, or supplied through the same credentials mechanism's manual-entry path where the operator must enter the secret. There is no separate opt-in exception: auto-enable-with-partner holds, and an operator-entered credential resolves through `credentials` like any other. This auto-enable-with-partner rule is distinct from update-automation-discovered addons (Decision 10), which are added hard-off.
 6. **Required addons are explicit, and install failure is gated by `required`.** Every addon carries a boolean `required` field (default `false`). Core components that are part of the deployed app contract, such as Odoo's core modules, use `required: true`: they are always installed, MAY omit `enabled`, and MUST NOT set `enabled: false`. The field also governs install-failure behaviour: when an addon's installation fails, a `required: true` addon MUST hard-fail the play (the deploy stops), while a `required: false` addon MUST only emit a warning, skip that addon, and let the play continue.
 7. **Workload-neutral contract.** The `meta/addons/` contract applies to any role type that declares role-level extensions, including desktop roles such as `desk-gnome-extensions`. The materialised path still uses the role's assembled application entry, `applications.<role_id>.addons`.
 8. **First slice.** The first end-to-end migration is `web-app-friendica` (`ldapauth`, bridges `ldap` to `svc-db-openldap`), because it already exercises the bridge rule and the service-flag enablement path.
@@ -121,7 +121,7 @@ Field rules:
 - `version` (optional) MUST be a string. `""` means "track the app's default". A concrete pin MUST be a string, never an unquoted number.
 - `group` (optional) is a free label used by roles that partition addons (e.g. Odoo `core` vs `optional`). It MUST NOT affect enablement.
 - `update` (optional) controls live upstream monitoring. `update.monitored` defaults to `false`; `update.catalog` MUST name a supported external-test catalog adapter; `update.upstream_id` defaults to `<addon_id>`.
-- `config` (optional) is an opaque, role-interpreted mapping holding the addon's full runtime configuration payload (e.g. Nextcloud `occ config:app` key/value sets, OIDC provider blocks). Lint MUST NOT constrain its inner shape beyond requiring a mapping; only the owning role's tasks read it. Secrets inside `config` MUST resolve through `lookup('config', application_id, 'credentials.<name>')` and MUST NOT be inlined literally. Lint enforces this with a bounded heuristic: any `config` value whose key matches a secret-name pattern (`*secret*`, `*password*`, `*token*`, `*client_secret*`, `*api_key*`, case-insensitive) MUST be a `lookup(..., 'credentials.<name>')` expression; a bare literal under such a key fails lint.
+- `config` (optional) is an opaque, role-interpreted mapping holding the addon's full runtime configuration payload (e.g. Nextcloud `occ config:app` key/value sets, OIDC provider blocks). Lint MUST NOT constrain its inner shape beyond requiring a mapping; only the owning role's tasks read it. Secrets inside `config` MUST resolve through `lookup('config', application_id, 'secrets.credentials.<name>')` and MUST NOT be inlined literally. Lint enforces this with a bounded heuristic: any `config` value whose key matches a secret-name pattern (`*secret*`, `*password*`, `*token*`, `*client_secret*`, `*api_key*`, case-insensitive) MUST be a `lookup(..., 'credentials.<name>')` expression; a bare literal under such a key fails lint.
 
 #### Worked example: absorbing per-addon config
 
@@ -162,7 +162,7 @@ config:
   bridge_name: telegram
   database_username: mautrix_telegram_bridge
   database_name: mautrix_telegram_bridge
-  database_password: "{{ lookup('config', application_id, 'credentials.mautrix_telegram_bridge_database_password') }}"
+  database_password: "{{ lookup('config', application_id, 'secrets.credentials.mautrix_telegram_bridge_database_password') }}"
 ```
 
 The bridge's database password stays declared in [meta/secrets.yml](../../roles/web-app-matrix/meta/secrets.yml) `credentials:` and is referenced, never inlined. Each additional network (`whatsapp`, `signal`, `slack`, `facebook`, `instagram`) is its own `mechanism: bridge` addon.

group_vars/all/11_oidc.yml

@@ -26,7 +26,7 @@ defaults_oidc:
   URL: "{{ _oidc_url }}"
   CLIENT:
     ID: "{{ _oidc_client_id }}" # Client identifier, typically matching your primary domain
-    SECRET: "{{ lookup('config', 'web-app-keycloak', 'credentials.oidc_client_secret', '') }}" # Defaults to the generated Keycloak credential; set OIDC.CLIENT.SECRET in the inventory to override
+    SECRET: "{{ lookup('config', 'web-app-keycloak', 'secrets.credentials.oidc_client_secret', '') }}" # Defaults to the generated Keycloak credential; set OIDC.CLIENT.SECRET in the inventory to override
     REALM: "{{ _oidc_client_realm }}" # The realm to which the client belongs in the OIDC provider
     ISSUER_URL: "{{ _oidc_client_issuer_url }}" # Issuer URL (must match discovery issuer)
     DISCOVERY_DOCUMENT: "{{ _oidc_client_issuer_url ~ '/.well-known/openid-configuration' }}" # URL for fetching the provider's configuration details

group_vars/all/12_ldap.yml

@@ -19,51 +19,20 @@ _ldap_user_id: "uid"
 _ldap_filters_users_all: "(|(objectclass=inetOrgPerson))"
 
 LDAP:
-  # Distinguished Names (DN)
   DN:
-    # -------------------------------------------------------------------------
-    # Base DN / Suffix
-    # This is the top-level naming context for your directory, used as the
-    # default search base for most operations (e.g. adding users, groups).
-    # Example: “dc=example,dc=com”
     ROOT: "{{ LDAP_DN_BASE }}"
     ADMINISTRATOR:
-      # -------------------------------------------------------------------------
-      # Data-Tree Administrator Bind DN
-      # The DN used to authenticate for regular directory operations under
-      # the data tree (adding users, modifying attributes, creating OUs, etc.).
-      # Typically: “cn=admin,dc=example,dc=com”
       DATA: "cn={{ lookup('users', 'administrator').username }},{{ LDAP_DN_BASE }}"
 
-      # -------------------------------------------------------------------------
-      # Config-Tree Administrator Bind DN
-      # The DN used to authenticate against the cn=config backend when you
-      # need to load or modify schema, overlays, modules, or other server-
-      # level settings.  
-      # Typically: “cn=admin,cn=config”
       CONFIGURATION: "cn={{ lookup('users', 'administrator').username }},cn=config"
 
     OU:
-      # -------------------------------------------------------------------------
-      # Organizational Units (OUs)
-      # Pre-created containers in the directory tree to logically separate entries:
-      # – users:  Contains all user objects (person/posixAccount entries).
-      # – groups: Contains organizational or business groups (e.g., departments, teams).
-      # – roles:  Contains application-specific RBAC roles 
-      #           (e.g., "cn=app1-user", "cn=yourls-admin").
       USERS: "ou=users,{{ LDAP_DN_BASE }}"
       GROUPS: "ou=groups,{{ LDAP_DN_BASE }}"
       ROLES: "ou=roles,{{ LDAP_DN_BASE }}"
 
-  # -------------------------------------------------------------------------
-  # Additional Notes
-  # – Always bind as data_admin for CRUD on entries under your base DN.
-  # – Always bind as config_admin when you push schema-level LDIFs via ldapi:///
-  # – Keeping these distinct prevents accidental use of config credentials
-  #   for ordinary user/group operations, and vice versa.
 
-  # Password to access dn.bind
-  BIND_CREDENTIAL: "{{ lookup('config','svc-db-openldap', 'credentials.administrator_database_password') }}"
+  BIND_CREDENTIAL: "{{ lookup('config','svc-db-openldap', 'secrets.credentials.administrator_database_password') }}"
   SERVER:
     DOMAIN: "{{ _ldap_name if _ldap_docker_network_enabled else _ldap_domain }}" # Mapping for public or locale access
     PORT: "{{ _ldap_server_port }}"
@@ -75,19 +44,12 @@ LDAP:
     OBJECTS:
       STRUCTURAL:
         - person # Structural Classes define the core identity of an entry:
-        # • Specify mandatory attributes (e.g. sn, cn)
-        # • Each entry must have exactly one structural class
         - inetOrgPerson # An extension of person adding internet-related attributes
-        # (e.g. mail, employeeNumber)
         - posixAccount # Provides UNIX account attributes (uidNumber, gidNumber,
-      # homeDirectory)
       AUXILIARY:
         NEXTCLOUD_USER: "nextcloudUser" # Auxiliary Classes attach optional attributes without
-        # changing the entry’s structural role. Here they add
-        # nextcloudQuota and nextcloudEnabled for Nextcloud.
         SSH_PUBLIC_KEY: "ldapPublicKey" # Allows storing SSH public keys for services like Gitea.
     ATTRIBUTES:
-      # Attribut to identify the user
       ID: "{{ _ldap_user_id }}"
       MAIL: "mail"
       FULLNAME: "cn"
@@ -101,7 +63,5 @@ LDAP:
       ALL: "{{ _ldap_filters_users_all }}"
   RBAC:
     FLAVORS:
-      # Valid values posixGroup, groupOfNames
       - groupOfNames
-      # - posixGroup
     EMPTY_MEMBER_DN: "cn=__empty__,{{ LDAP.DN.ROOT }}"

roles/desk-nextcloud/vars/main.yml

@@ -1,7 +1,7 @@
 ---
 application_id: desk-nextcloud
 nextcloud_user_home_directory: "/home/{{ lookup('users', WORKSTATION_USER).username }}/"
-nextcloud_cloud_fqdn: "{{ lookup('config', application_id, 'credentials.cloud_fqdn') }}"
+nextcloud_cloud_fqdn: "{{ lookup('config', application_id, 'secrets.credentials.cloud_fqdn') }}"
 nextcloud_cloud_directory: "{{ nextcloud_user_home_directory }}Clouds/{{ nextcloud_cloud_fqdn }}/{{ lookup('users', WORKSTATION_USER).username }}/"
 
 nextcloud_dotlinker_folders:

roles/svc-db-elasticsearch/vars/main.yml

@@ -6,7 +6,7 @@ database_type: "{{ entity_name }}"
 
 ELASTICSEARCH_CONTAINER: "{{ lookup('config', application_id, 'services.' ~ entity_name ~ '.name') }}"
 ELASTICSEARCH_CONTAINER_ADDRESS: "{{ lookup('container_address', application_id, ELASTICSEARCH_CONTAINER) }}"
-ELASTICSEARCH_PASSWORD: "{{ lookup('config', application_id, 'credentials.ELASTIC_PASSWORD') }}"
+ELASTICSEARCH_PASSWORD: "{{ lookup('config', application_id, 'secrets.credentials.ELASTIC_PASSWORD') }}"
 ELASTICSEARCH_EXPOSE_LOCAL: true
 ELASTICSEARCH_LOCAL_HOST: "127.0.0.1"
 ELASTICSEARCH_INTERNAL_PORT: "{{ lookup('config', application_id, 'services.elasticsearch.ports.internal.elasticsearch') }}"

roles/svc-db-mariadb/vars/main.yml

@@ -3,7 +3,7 @@ application_id: svc-db-mariadb
 entity_name: "{{ application_id | get_entity_name }}"
 database_type: "{{ entity_name }}"
 
-MARIADB_ROOT_PWD: "{{ lookup('config', application_id, 'credentials.root_password') }}"
+MARIADB_ROOT_PWD: "{{ lookup('config', application_id, 'secrets.credentials.root_password') }}"
 MARIADB_VOLUME: "{{ lookup('volume', application_id, 'data').name }}"
 MARIADB_IMAGE: "{{ lookup('config', application_id, 'services.' ~ entity_name ~ '.image') }}"
 MARIADB_VERSION: "{{ lookup('config', application_id, 'services.' ~ entity_name ~ '.version') }}"
@@ -18,11 +18,6 @@ MARIADB_SWARM_SERVICE: "{{ entity_name }}_{{ MARIADB_NAME }}"
 MARIADB_HEALTHCHECK_DB: "{{ SOFTWARE_DOMAIN | regex_replace('[^a-z0-9]+', '_') }}_healthcheck"
 
 MARIADB_EXPOSED: "{{ lookup('config', application_id, 'services.mariadb.exposed') | bool }}"
-# Host behavior stays unchanged (True).
-# In CI/act container environments we avoid publishing ports to prevent iptables/nft issues,
-# unless `exposed` opts in (needed so the port is reachable over the onion).
 MARIADB_EXPOSE_LOCAL: "{{ MARIADB_EXPOSED | bool or not DOCKER_IN_CONTAINER | bool }}"
 
-# If the desired root password doesn't work, allow an automated reset without knowing the previous password.
-# This uses a recovery container with --skip-grant-tables (downtime). Keep disabled by default.
 MARIADB_ALLOW_RESET_WITHOUT_PREVIOUS: true

roles/svc-db-postgres/vars/main.yml

@@ -9,7 +9,7 @@ POSTGRES_CONTAINER_ADDRESS: "{{ lookup('container_address', application_id, enti
 POSTGRES_IMAGE: "{{ lookup('config', application_id, 'services.' ~ entity_name ~ '.image') }}"
 POSTGRES_VERSION: "{{ lookup('config', application_id, 'services.' ~ entity_name ~ '.version') }}"
 POSTGRES_VERSION_MAJOR: "{{ POSTGRES_VERSION | regex_replace('^([0-9]+).*', '\\1') }}"
-POSTGRES_PASSWORD: "{{ lookup('config', application_id, 'credentials.POSTGRES_PASSWORD') }}"
+POSTGRES_PASSWORD: "{{ lookup('config', application_id, 'secrets.credentials.POSTGRES_PASSWORD') }}"
 POSTGRES_PORT: "{{ database_port | default(lookup('config', application_id, 'services.postgres.ports.local.postgres')) }}"
 POSTGRES_EXPOSE_LOCAL: true
 POSTGRES_LOCAL_HOST: "127.0.0.1"

roles/svc-db-rabbitmq/vars/main.yml

@@ -7,7 +7,7 @@ database_type: "{{ entity_name }}"
 RABBITMQ_CONTAINER: "{{ lookup('config', application_id, 'services.' ~ entity_name ~ '.name') }}"
 RABBITMQ_CONTAINER_ADDRESS: "{{ lookup('container_address', application_id, RABBITMQ_CONTAINER) }}"
 RABBITMQ_USER: "admin"
-RABBITMQ_PASSWORD: "{{ lookup('config', application_id, 'credentials.RABBITMQ_PASSWORD') }}"
+RABBITMQ_PASSWORD: "{{ lookup('config', application_id, 'secrets.credentials.RABBITMQ_PASSWORD') }}"
 RABBITMQ_EXPOSE_LOCAL: true
 RABBITMQ_RETRIES: 30
 RABBITMQ_DELAY: 5

roles/svc-db-redis/vars/main.yml

@@ -6,7 +6,7 @@ database_type: "{{ entity_name }}"
 
 REDIS_CONTAINER: "{{ lookup('config', application_id, 'services.' ~ entity_name ~ '.name') }}"
 REDIS_CONTAINER_ADDRESS: "{{ lookup('container_address', application_id, entity_name) }}"
-REDIS_PASSWORD: "{{ lookup('config', application_id, 'credentials.REDIS_PASSWORD') }}"
+REDIS_PASSWORD: "{{ lookup('config', application_id, 'secrets.credentials.REDIS_PASSWORD') }}"
 REDIS_EXPOSE_LOCAL: true
 REDIS_RETRIES: 5
 REDIS_DELAY: 5

roles/svc-db-typesense/vars/main.yml

@@ -3,7 +3,7 @@ application_id: svc-db-typesense
 entity_name: "{{ application_id | get_entity_name }}"
 database_type: "{{ entity_name }}"
 
-TYPESENSE_API_KEY: "{{ lookup('config', application_id, 'credentials.api_key') }}"
+TYPESENSE_API_KEY: "{{ lookup('config', application_id, 'secrets.credentials.api_key') }}"
 TYPESENSE_NAME: "{{ lookup('config', application_id, 'services.' ~ entity_name ~ '.name') }}"
 TYPESENSE_CONTAINER_ADDRESS: "{{ lookup('container_address', application_id, TYPESENSE_NAME) }}"
 TYPESENSE_RETRIES: 30

roles/web-app-akaunting/vars/main.yml

@@ -1,7 +1,7 @@
 ---
 application_id: "web-app-akaunting"
 
-database_password: "{{ lookup('config', application_id, 'credentials.database_password') }}" # nocheck: lookup-config-path
+database_password: "{{ lookup('config', application_id, 'secrets.credentials.database_password') }}" # nocheck: lookup-config-path
 
 AKAUNTING_URL: "{{ lookup('tls', application_id, 'url.base') }}"
 AKAUNTING_IMAGE: "{{ lookup('config', application_id, 'services.akaunting.image') }}"
@@ -13,13 +13,13 @@ AKAUNTING_VOLUME: "{{ lookup('volume', application_id, 'data').name }}"
 AKAUNTING_COMPANY_NAME: "{{ lookup('config', application_id, 'services.akaunting.company.name') }}"
 AKAUNTING_COMPANY_EMAIL: "{{ lookup('config', application_id, 'services.akaunting.company.email') }}"
 AKAUNTING_ADMIN_EMAIL: "{{ lookup('config', application_id, 'services.akaunting.setup_admin_email') }}"
-AKAUNTING_ADMIN_PASSWORD: "{{ lookup('config', application_id, 'credentials.setup_admin_password') }}"
+AKAUNTING_ADMIN_PASSWORD: "{{ lookup('config', application_id, 'secrets.credentials.setup_admin_password') }}"
 AKAUNTING_SETUP_MARKER: "{{ [ akaunting_volume_mountpoint.stdout | trim, '.akaunting_installed' ] | path_join }}"
 AKAUNTING_SERVICE: "{{ lookup('container_service', application_id, 'akaunting') }}"
 AKAUNTING_SETUP_JOB: "{{ AKAUNTING_SERVICE }}_setup"
 AKAUNTING_ENTRYPOINT: "/usr/local/bin/akaunting.sh"
 AKAUNTING_REPLICAS: "{{ groups[application_id] | length }}"
-AKAUNTING_APP_KEY: "{{ lookup('config', application_id, 'credentials.app_key') }}"
+AKAUNTING_APP_KEY: "{{ lookup('config', application_id, 'secrets.credentials.app_key') }}"
 AKAUNTING_CACHE_DRIVER: "{{ 'redis' if lookup('config',application_id, 'services.redis.enabled') else 'file' }}"
 
 AKAUNTING_LDAP_ENABLED: "{{ lookup('config', application_id, 'services.ldap.enabled') }}"

roles/web-app-baserow/vars/main.yml

@@ -1,19 +1,18 @@
 ---
 application_id: "web-app-baserow"
 entity_name: "{{ application_id | get_entity_name }}"
-database_password: "{{ lookup('config', application_id, 'credentials.database_password') }}" # nocheck: lookup-config-path
+database_password: "{{ lookup('config', application_id, 'secrets.credentials.database_password') }}" # nocheck: lookup-config-path
 
 BASEROW_PUBLIC_URL: "{{ lookup('tls', application_id, 'url.base') }}"
 BASEROW_VERSION: "{{ lookup('config', application_id, 'services.baserow.version') }}"
 BASEROW_IMAGE: "{{ lookup('config', application_id, 'services.baserow.image') }}"
 BASEROW_CONTAINER: "{{ lookup('config', application_id, 'services.baserow.name') }}"
 
-# Auth integrations
 BASEROW_SSO_PROXY_GATED: "{{ lookup('sso', application_id, 'is_proxy_gated') }}"
 BASEROW_SSO_ADMIN_GROUP: "/{{ lookup('rbac_group_path', application_id=application_id, role='administrator') }}"
 BASEROW_SSO_FALLBACK_EMAIL_DOMAIN: "{{ lookup('domain', application_id) }}"
 
-BASEROW_SECRET_KEY: "{{ lookup('config', application_id, 'credentials.secret_key') }}"
+BASEROW_SECRET_KEY: "{{ lookup('config', application_id, 'secrets.credentials.secret_key') }}"
 
 BASEROW_DATABASE_USER: "{{ lookup('database', application_id, 'username') }}"
 BASEROW_DATABASE_NAME: "{{ lookup('database', application_id, 'name') }}"

roles/web-app-bigbluebutton/tasks/00_core.yml

@@ -30,7 +30,7 @@
     database_host: "127.0.0.1"
     database_port: "5432"
     database_username: "postgres"
-    database_password: "{{ lookup('config', application_id, 'credentials.postgresql_secret') }}"
+    database_password: "{{ lookup('config', application_id, 'secrets.credentials.postgresql_secret') }}"
     database_name: "" # Multiple databases
   when:
     - "'svc-bkp-volume-2-local' in group_names"

roles/web-app-bigbluebutton/vars/main.yml

@@ -12,13 +12,13 @@ BBB_REF: "{{ lookup('config', application_id, 'services.' ~ entity_name ~ '.ref'
 
 _BBB_COTURN_ROLE: "web-svc-coturn"
 
-BBB_SHARED_SECRET: "{{ lookup('config', application_id, 'credentials.shared_secret') }}"
-BBB_ETHERPAD_API_KEY: "{{ lookup('config', application_id, 'credentials.etherpad_api_key') }}"
-BBB_RAILS_SECRET: "{{ lookup('config', application_id, 'credentials.rails_secret') }}"
-BBB_POSTGRESQL_SECRET: "{{ lookup('config', application_id, 'credentials.postgresql_secret') }}"
-BBB_FSESL_PASSWORD: "{{ lookup('config', application_id, 'credentials.fsesl_password') }}"
-BBB_TURN_SECRET_LOCAL: "{{ lookup('config', application_id, 'credentials.turn_secret') }}"
-BBB_TURN_SECRET_SHARED: "{{ lookup('config',_BBB_COTURN_ROLE, 'credentials.auth_secret') }}"
+BBB_SHARED_SECRET: "{{ lookup('config', application_id, 'secrets.credentials.shared_secret') }}"
+BBB_ETHERPAD_API_KEY: "{{ lookup('config', application_id, 'secrets.credentials.etherpad_api_key') }}"
+BBB_RAILS_SECRET: "{{ lookup('config', application_id, 'secrets.credentials.rails_secret') }}"
+BBB_POSTGRESQL_SECRET: "{{ lookup('config', application_id, 'secrets.credentials.postgresql_secret') }}"
+BBB_FSESL_PASSWORD: "{{ lookup('config', application_id, 'secrets.credentials.fsesl_password') }}"
+BBB_TURN_SECRET_LOCAL: "{{ lookup('config', application_id, 'secrets.credentials.turn_secret') }}"
+BBB_TURN_SECRET_SHARED: "{{ lookup('config',_BBB_COTURN_ROLE, 'secrets.credentials.auth_secret') }}"
 BBB_TURN_SECRET: "{{ BBB_COTURN_LOCAL_ENABLED  | bool | ternary (BBB_TURN_SECRET_LOCAL, BBB_TURN_SECRET_SHARED) }}"
 
 BBB_COTURN_TLS_CERT_PATH: "{{ lookup('cert', application_id, 'files.cert') }}"

roles/web-app-bluesky/vars/main.yml

@@ -33,8 +33,8 @@ BLUESKY_PDS_HANDLE_DOMAIN: "{{ DOMAIN_PRIMARY | regex_replace('\\.(example|test|
 
 BLUESKY_LDAP_ENABLED: "{{ lookup('config', application_id, 'services.ldap.enabled') }}"
 
-BLUESKY_JWT_SECRET: "{{ lookup('config', application_id, 'credentials.jwt_secret') }}"
-BLUESKY_ROTATION_KEY: "{{ lookup('config', application_id, 'credentials.plc_rotation_key_k256_private_key_hex') }}"
+BLUESKY_JWT_SECRET: "{{ lookup('config', application_id, 'secrets.credentials.jwt_secret') }}"
+BLUESKY_ROTATION_KEY: "{{ lookup('config', application_id, 'secrets.credentials.plc_rotation_key_k256_private_key_hex') }}"
 
 BLUESKY_ADMIN_EMAIL: "{{ lookup('users', 'administrator').email }}"
 BLUESKY_ADMIN_PASSWORD: "{{ lookup('users', 'administrator').password }}"
@@ -54,7 +54,7 @@ BLUESKY_BROKER_CONTAINER: "{{ lookup('config', application_id, 'services.' ~ BLU
 BLUESKY_BROKER_PORT: "{{ lookup('config', application_id, 'services.broker.ports.local.http') }}"
 BLUESKY_BROKER_INTERNAL_PORT: "{{ lookup('config', application_id, 'services.broker.ports.internal.http') }}"
 
-BLUESKY_BRIDGE_ENCRYPTION_KEY: "{{ lookup('config', application_id, 'credentials.bridge_encryption_key') }}"
+BLUESKY_BRIDGE_ENCRYPTION_KEY: "{{ lookup('config', application_id, 'secrets.credentials.bridge_encryption_key') }}"
 
 BLUESKY_SSO_PROXY_CONTAINER: "{{ lookup('config', application_id, 'services.sso-proxy.name') }}"
 BLUESKY_SSO_PROXY_CFG_PATH: "{{ [ lookup('container', application_id, 'directories.volumes'), lookup('config', 'web-app-keycloak', 'services.sso_proxy.configuration_file')

roles/web-app-bookwyrm/vars/main.yml

@@ -8,7 +8,7 @@ container_hostname: "{{ lookup('container_hostname', application_id) }}"
 BOOKWYRM_REGISTRATION_OPEN: "{{ lookup('config', application_id, 'services.bookwyrm.registration_open') | string | lower }}"
 BOOKWYRM_ALLOW_INVITE_REQUESTS: "{{ lookup('config', application_id, 'services.bookwyrm.allow_invite_request') | string | lower }}"
 
-BOOKWYRM_SECRET_KEY: "{{ lookup('config', application_id, 'credentials.secret_key') }}"
+BOOKWYRM_SECRET_KEY: "{{ lookup('config', application_id, 'secrets.credentials.secret_key') }}"
 
 BOOKWYRM_URL: "{{ lookup('tls', application_id, 'url.base') }}"
 BOOKWYRM_HOSTNAME: "{{ lookup('domain', application_id) }}"

roles/web-app-checkmk/vars/main.yml

@@ -5,7 +5,7 @@ container_port: "{{ lookup('config', application_id, 'services.checkmk.ports.int
 CHECKMK_NAME: "{{ lookup('config', application_id, 'services.checkmk.name') }}"
 CHECKMK_SITE: "cmk"
 
-CHECKMK_ADMIN_PASSWORD: "{{ lookup('config', application_id, 'credentials.cmk_password') }}"
+CHECKMK_ADMIN_PASSWORD: "{{ lookup('config', application_id, 'secrets.credentials.cmk_password') }}"
 
 CHECKMK_SSO_ENABLED: "{{ lookup('config', application_id, 'services.sso.enabled') }}"
 CHECKMK_LDAP_ENABLED: "{{ lookup('config', application_id, 'services.ldap.enabled') }}"

roles/web-app-chess/vars/main.yml

@@ -14,7 +14,7 @@ CHESS_ADMIN_EMAIL: "{{ lookup('users', 'administrator').email }}"
 CHESS_SERVICE: "{{ entity_name }}"
 CHESS_CONTAINER: "{{ lookup('config', application_id, 'services.' ~ entity_name ~ '.name') }}"
 
-CHESS_HMAC_SECRET: "{{ lookup('config', application_id, 'credentials.hmac_secret') }}"
+CHESS_HMAC_SECRET: "{{ lookup('config', application_id, 'secrets.credentials.hmac_secret') }}"
 CHESS_KEY_FILENAME: "signing-key"
 CHESS_APP_DATA_DIR: "/app/data"
 CHESS_APP_KEY_FILE: "{{ [ CHESS_APP_DATA_DIR, CHESS_KEY_FILENAME ] | path_join }}"

roles/web-app-decidim/vars/main.yml

@@ -7,7 +7,7 @@ DECIDIM_VERSION: "{{ lookup('config', application_id, 'services.decidim.version'
 DECIDIM_IMAGE: "{{ lookup('config', application_id, 'services.decidim.image') }}"
 DECIDIM_CONTAINER: "{{ lookup('config', application_id, 'services.decidim.name') }}"
 
-DECIDIM_SECRET_KEY_BASE: "{{ lookup('config', application_id, 'credentials.secret_key_base') }}"
+DECIDIM_SECRET_KEY_BASE: "{{ lookup('config', application_id, 'secrets.credentials.secret_key_base') }}"
 
 DECIDIM_OIDC_ENABLED: "{{ lookup('config', application_id, 'services.sso.enabled') }}"
 DECIDIM_OIDC_CLIENT_ID: "{{ OIDC.CLIENT.ID }}"

roles/web-app-discourse/vars/main.yml

@@ -2,7 +2,7 @@
 application_id: "web-app-discourse"
 entity_name: "{{ application_id | get_entity_name }}"
 
-database_password: "{{ lookup('config', application_id, 'credentials.database_password') }}" # nocheck: lookup-config-path
+database_password: "{{ lookup('config', application_id, 'secrets.credentials.database_password') }}" # nocheck: lookup-config-path
 
 DISCOURSE_CONTAINER: "{{ entity_name }}"
 DISCOURSE_NETWORK: "{{ application_id | get_entity_name }}"

roles/web-app-erpnext/vars/main.yml

@@ -16,9 +16,9 @@ ERPNEXT_WEBSOCKET_PORT: "{{ lookup('config', application_id, 'services.websocket
 ERPNEXT_HOSTNAME: "{{ lookup('domain', application_id) }}"
 ERPNEXT_SITE_NAME: "{{ ERPNEXT_HOSTNAME }}"
 
-ERPNEXT_INITIAL_ADMIN_PASSWORD: "{{ lookup('config', application_id, 'credentials.initial_admin_password') }}"
-ERPNEXT_API_BOT_PASSWORD: "{{ lookup('config', application_id, 'credentials.api_bot_password') }}"
-ERPNEXT_API_KEY_SECRET: "{{ lookup('config', application_id, 'credentials.api_key_secret') }}"
+ERPNEXT_INITIAL_ADMIN_PASSWORD: "{{ lookup('config', application_id, 'secrets.credentials.initial_admin_password') }}"
+ERPNEXT_API_BOT_PASSWORD: "{{ lookup('config', application_id, 'secrets.credentials.api_bot_password') }}"
+ERPNEXT_API_KEY_SECRET: "{{ lookup('config', application_id, 'secrets.credentials.api_key_secret') }}"
 
 ERPNEXT_API_BOT_USER: "{{ lookup('users', 'erpnext-api-bot') }}"
 
@@ -31,7 +31,7 @@ ERPNEXT_DB_PORT: "{{ lookup('database', application_id, 'port') }}"
 
 ERPNEXT_DB_ROOT_USER: "root"
 ERPNEXT_DB_ROOT_PASSWORD: >-
-  {{ lookup('config', 'svc-db-mariadb', 'credentials.root_password')
+  {{ lookup('config', 'svc-db-mariadb', 'secrets.credentials.root_password')
      if (lookup('config', application_id, 'services.mariadb.shared') | bool)
      else lookup('database', application_id, 'password') }}
 

roles/web-app-espocrm/templates/env.j2

@@ -10,7 +10,7 @@ ESPOCRM_DATABASE_PASSWORD={{ lookup('database', application_id, 'password') | do
 CRON_DISABLED=true
 
 ESPOCRM_ADMIN_USERNAME={{ lookup('config', application_id, 'users.administrator.username') }}
-ESPOCRM_ADMIN_PASSWORD={{ lookup('config', application_id, 'credentials.administrator_password') | dotenv_quote }}
+ESPOCRM_ADMIN_PASSWORD={{ lookup('config', application_id, 'secrets.credentials.administrator_password') | dotenv_quote }}
 
 ESPOCRM_SITE_URL={{ ESPOCRM_URL }}
 

roles/web-app-espocrm/templates/playwright.env.j2

@@ -1,4 +1,4 @@
-ADMIN_NATIVE_PASSWORD={{ lookup('config', application_id, 'credentials.administrator_password') | dotenv_quote }}
+ADMIN_NATIVE_PASSWORD={{ lookup('config', application_id, 'secrets.credentials.administrator_password') | dotenv_quote }}
 
 ADMIN_PASSWORD={{ lookup('users', 'administrator').password | dotenv_quote }}
 

roles/web-app-espocrm/vars/main.yml

@@ -32,5 +32,5 @@ ESPOCRM_CRON_DISABLED: "{{ ESPOCRM_MAINTENANCE_MODE }}"
 ESPOCRM_USE_CACHE: "{{ not ESPOCRM_MAINTENANCE_MODE }}"
 
 ESPOCRM_RECAPTCHA_ENABLED: "{{ lookup('config', application_id, 'services.recaptcha.enabled') }}"
-ESPOCRM_RECAPTCHA_KEY: "{{ lookup('config', application_id, 'credentials.recaptcha.key') }}"
-ESPOCRM_RECAPTCHA_SECRET: "{{ lookup('config', application_id, 'credentials.recaptcha.secret') }}"
+ESPOCRM_RECAPTCHA_KEY: "{{ lookup('config', application_id, 'secrets.credentials.recaptcha.key') }}"
+ESPOCRM_RECAPTCHA_SECRET: "{{ lookup('config', application_id, 'secrets.credentials.recaptcha.secret') }}"

roles/web-app-flowise/templates/env.j2

@@ -13,11 +13,11 @@ DATABASE_NAME={{ lookup('database', application_id, 'name') }}
 DATABASE_USER={{ lookup('database', application_id, 'username') }}
 DATABASE_PASSWORD={{ lookup('database', application_id, 'password') | dotenv_quote }}
 FLOWISE_FILE_STORAGE_PATH=/root/.flowise/storage
-FLOWISE_SECRETKEY_OVERWRITE={{ lookup('config', application_id, 'credentials.secret_key') | dotenv_quote }}
-JWT_AUTH_TOKEN_SECRET={{ lookup('config', application_id, 'credentials.jwt_auth_token_secret') | dotenv_quote }}
-JWT_REFRESH_TOKEN_SECRET={{ lookup('config', application_id, 'credentials.jwt_refresh_token_secret') | dotenv_quote }}
-EXPRESS_SESSION_SECRET={{ lookup('config', application_id, 'credentials.express_session_secret') | dotenv_quote }}
-TOKEN_HASH_SECRET={{ lookup('config', application_id, 'credentials.token_hash_secret') | dotenv_quote }}
+FLOWISE_SECRETKEY_OVERWRITE={{ lookup('config', application_id, 'secrets.credentials.secret_key') | dotenv_quote }}
+JWT_AUTH_TOKEN_SECRET={{ lookup('config', application_id, 'secrets.credentials.jwt_auth_token_secret') | dotenv_quote }}
+JWT_REFRESH_TOKEN_SECRET={{ lookup('config', application_id, 'secrets.credentials.jwt_refresh_token_secret') | dotenv_quote }}
+EXPRESS_SESSION_SECRET={{ lookup('config', application_id, 'secrets.credentials.express_session_secret') | dotenv_quote }}
+TOKEN_HASH_SECRET={{ lookup('config', application_id, 'secrets.credentials.token_hash_secret') | dotenv_quote }}
 
 {% if lookup('engine', 'qdrant', application_id, 'enabled') %}
 QDRANT_URL={{ FLOWISE_QDRANT_INTERNAL_URL }}

roles/web-app-flowise/vars/main.yml

@@ -14,6 +14,6 @@ FLOWISE_LITELLM_PORT: "{{ lookup('config', application_id, 'services.litellm.por
 FLOWISE_LITELLM_INTERNAL_URL: "http://litellm:{{ FLOWISE_LITELLM_PORT }}"
 FLOWISE_LITELLM_CONFIG_PATH_HOST: "{{ [ lookup('container', application_id, 'directories.config'), 'litellm.config.yaml' ] | path_join }}"
 FLOWISE_LITELLM_CONFIG_PATH_DOCKER: "/etc/litellm/config.yaml"
-FLOWISE_LITELLM_MASTER_KEY: "{{ lookup('config', application_id, 'credentials.llm_master_key') }}"
+FLOWISE_LITELLM_MASTER_KEY: "{{ lookup('config', application_id, 'secrets.credentials.llm_master_key') }}"
 
 FLOWISE_QDRANT_INTERNAL_URL: "{{ lookup('engine', 'qdrant', application_id, 'url') }}"

roles/web-app-funkwhale/templates/env.j2

@@ -38,7 +38,7 @@ STATIC_ROOT={{FUNKWHALE_STATIC_DIR}}
 
 DJANGO_SETTINGS_MODULE=config.settings.production
 
-DJANGO_SECRET_KEY={{ lookup('config', application_id, 'credentials.django_secret')}}
+DJANGO_SECRET_KEY={{ lookup('config', application_id, 'secrets.credentials.django_secret')}}
 
 {% if lookup('config',application_id, 'services.ldap.enabled', False) %}
 LDAP_ENABLED=True

roles/web-app-funkwhale/vars/main.yml

@@ -7,4 +7,4 @@ FUNKWHALE_MUSIC_DIR: "{{ [ FUNKWHALE_DATA_ROOT, 'music' ]  | path_join }}"
 FUNKWHALE_STATIC_DIR: "{{ [ FUNKWHALE_DATA_ROOT, 'static' ]  | path_join }}"
 FUNKWHALE_CELERYD_CONCURRENCY: 1
 FUNKWHALE_DOCKER_API_PORT: "{{ lookup('config', application_id, 'services.api.ports.internal.http') }}"
-FUNKWHALE_TYPESENSE_API_KEY: "{{ lookup('config', application_id, 'credentials.api_key') }}"
+FUNKWHALE_TYPESENSE_API_KEY: "{{ lookup('config', application_id, 'secrets.credentials.api_key') }}"

roles/web-app-gitea/templates/env.j2

@@ -82,7 +82,7 @@ GITEA__service__DISABLE_REGISTRATION={{ GITEA_IAM_ENABLED | lower }}
 
 {% if lookup('config', application_id, 'services.prometheus.native_metrics.enabled', False) | bool %}
 GITEA__metrics__ENABLED=true
-{% set _metrics_token = lookup('config', application_id, 'credentials.native_metrics_token', '') %}
+{% set _metrics_token = lookup('config', application_id, 'secrets.credentials.native_metrics_token', '') %}
 {% if _metrics_token %}
 GITEA__metrics__TOKEN={{ _metrics_token }}
 {% endif %}

roles/web-app-gitea/templates/prometheus.yml.j2

@@ -4,7 +4,7 @@
   - job_name: "gitea"
     scheme: http
     metrics_path: /metrics
-{% set _token = lookup('config', native_prometheus_application_id, 'credentials.native_metrics_token', '') %}
+{% set _token = lookup('config', native_prometheus_application_id, 'secrets.credentials.native_metrics_token', '') %}
 {% if _token %}
     bearer_token: "{{ _token }}"
 {% endif %}

roles/web-app-gitlab/templates/config/secrets.yml.j2

@@ -1,13 +1,13 @@
 ---
 production:
-  secret_key_base: {{ lookup('config', application_id, 'credentials.secret_key_base') | to_json }}
-  otp_key_base: {{ lookup('config', application_id, 'credentials.otp_key_base') | to_json }}
-  db_key_base: {{ lookup('config', application_id, 'credentials.db_key_base') | to_json }}
-  encrypted_settings_key_base: {{ lookup('config', application_id, 'credentials.encrypted_settings_key_base') | to_json }}
+  secret_key_base: {{ lookup('config', application_id, 'secrets.credentials.secret_key_base') | to_json }}
+  otp_key_base: {{ lookup('config', application_id, 'secrets.credentials.otp_key_base') | to_json }}
+  db_key_base: {{ lookup('config', application_id, 'secrets.credentials.db_key_base') | to_json }}
+  encrypted_settings_key_base: {{ lookup('config', application_id, 'secrets.credentials.encrypted_settings_key_base') | to_json }}
   openid_connect_signing_key: |
-{{ lookup('config', application_id, 'credentials.openid_connect_signing_key') | trim | indent(4, true) }}
+{{ lookup('config', application_id, 'secrets.credentials.openid_connect_signing_key') | trim | indent(4, true) }}
   active_record_encryption_primary_key:
-    - {{ lookup('config', application_id, 'credentials.active_record_encryption_primary_key') | to_json }}
+    - {{ lookup('config', application_id, 'secrets.credentials.active_record_encryption_primary_key') | to_json }}
   active_record_encryption_deterministic_key:
-    - {{ lookup('config', application_id, 'credentials.active_record_encryption_deterministic_key') | to_json }}
-  active_record_encryption_key_derivation_salt: {{ lookup('config', application_id, 'credentials.active_record_encryption_key_derivation_salt') | to_json }}
+    - {{ lookup('config', application_id, 'secrets.credentials.active_record_encryption_deterministic_key') | to_json }}
+  active_record_encryption_key_derivation_salt: {{ lookup('config', application_id, 'secrets.credentials.active_record_encryption_key_derivation_salt') | to_json }}

roles/web-app-gitlab/vars/main.yml

@@ -42,9 +42,9 @@ GITLAB_REDIS_PORT: "{{ lookup('engine', 'redis', application_id, 'port') }}"
 GITLAB_REDIS_PASSWORD: "{{ lookup('engine', 'redis', application_id, 'password') }}"
 GITLAB_REDIS_URL: "redis://{% if GITLAB_REDIS_PASSWORD %}:{{ GITLAB_REDIS_PASSWORD | urlencode }}@{% endif %}{{ GITLAB_REDIS_HOST }}:{{ GITLAB_REDIS_PORT }}"
 
-GITLAB_SHELL_SECRET: "{{ lookup('config', application_id, 'credentials.gitlab_shell_secret') }}"
-GITLAB_GITALY_TOKEN: "{{ lookup('config', application_id, 'credentials.gitaly_token') }}"
-GITLAB_WORKHORSE_SECRET: "{{ lookup('config', application_id, 'credentials.workhorse_secret') }}"
+GITLAB_SHELL_SECRET: "{{ lookup('config', application_id, 'secrets.credentials.gitlab_shell_secret') }}"
+GITLAB_GITALY_TOKEN: "{{ lookup('config', application_id, 'secrets.credentials.gitaly_token') }}"
+GITLAB_WORKHORSE_SECRET: "{{ lookup('config', application_id, 'secrets.credentials.workhorse_secret') }}"
 
 GITLAB_CONFIG_DIR: "{{ lookup('container', application_id, 'directories.config') }}"
 GITLAB_CONFIG_RAILS_DIR: "{{ [GITLAB_CONFIG_DIR, 'rails'] | path_join }}"

roles/web-app-jellyfin/vars/main.yml

@@ -7,7 +7,7 @@ JELLYFIN_BASE_URL: "{{ lookup('tls', application_id, 'url.base') }}"
 JELLYFIN_API: "http://{{ DOCKER_BIND_HOST }}:{{ lookup('config', application_id, 'services.jellyfin.ports.local.http') }}"
 
 JELLYFIN_ADMIN_USERNAME: "{{ lookup('users', 'administrator').username }}"
-JELLYFIN_ADMIN_PASSWORD: "{{ lookup('config', application_id, 'credentials.administrator_password') }}"
+JELLYFIN_ADMIN_PASSWORD: "{{ lookup('config', application_id, 'secrets.credentials.administrator_password') }}"
 
 JELLYFIN_SSO_ENABLED: "{{ lookup('config', application_id, 'services.sso.enabled') }}"
 JELLYFIN_LDAP_ENABLED: "{{ lookup('config', application_id, 'services.ldap.enabled') }}"

roles/web-app-jitsi/vars/main.yml

@@ -34,12 +34,12 @@ JITSI_XMPP_MUC_DOMAIN: "muc.meet.jitsi"
 JITSI_XMPP_INTERNAL_MUC_DOMAIN: "internal-muc.meet.jitsi"
 JITSI_XMPP_RECORDER_DOMAIN: "recorder.meet.jitsi"
 
-JITSI_JICOFO_COMPONENT_SECRET: "{{ lookup('config', application_id, 'credentials.jicofo_component_secret') }}"
-JITSI_JICOFO_AUTH_PASSWORD: "{{ lookup('config', application_id, 'credentials.jicofo_auth_password') }}"
-JITSI_JVB_AUTH_PASSWORD: "{{ lookup('config', application_id, 'credentials.jvb_auth_password') }}"
-JITSI_JIGASI_XMPP_PASSWORD: "{{ lookup('config', application_id, 'credentials.jigasi_xmpp_password') }}"
-JITSI_JIBRI_RECORDER_PASSWORD: "{{ lookup('config', application_id, 'credentials.jibri_recorder_password') }}"
-JITSI_JIBRI_XMPP_PASSWORD: "{{ lookup('config', application_id, 'credentials.jibri_xmpp_password') }}"
+JITSI_JICOFO_COMPONENT_SECRET: "{{ lookup('config', application_id, 'secrets.credentials.jicofo_component_secret') }}"
+JITSI_JICOFO_AUTH_PASSWORD: "{{ lookup('config', application_id, 'secrets.credentials.jicofo_auth_password') }}"
+JITSI_JVB_AUTH_PASSWORD: "{{ lookup('config', application_id, 'secrets.credentials.jvb_auth_password') }}"
+JITSI_JIGASI_XMPP_PASSWORD: "{{ lookup('config', application_id, 'secrets.credentials.jigasi_xmpp_password') }}"
+JITSI_JIBRI_RECORDER_PASSWORD: "{{ lookup('config', application_id, 'secrets.credentials.jibri_recorder_password') }}"
+JITSI_JIBRI_XMPP_PASSWORD: "{{ lookup('config', application_id, 'secrets.credentials.jibri_xmpp_password') }}"
 
 JITSI_AUTH_TYPE: "{{ 'ldap' if (JITSI_LDAP_ENABLED and not JITSI_OIDC_ENABLED) else 'internal' }}"
 JITSI_ENABLE_AUTH: "{{ JITSI_AUTH_TYPE != 'internal' }}"

roles/web-app-keycloak/templates/sso_proxy/oauth2-proxy-keycloak.cfg.j2

@@ -1,5 +1,5 @@
 http_address            =   "0.0.0.0:{{ lookup('config', 'web-app-keycloak', 'services.sso_proxy.ports.internal.http') }}"
-cookie_secret           =   "{{ lookup('config', sso_proxy_application_id, 'credentials.sso_proxy_cookie_secret') }}"
+cookie_secret           =   "{{ lookup('config', sso_proxy_application_id, 'secrets.credentials.sso_proxy_cookie_secret') }}"
 cookie_secure           =   "{{ lookup('tls', sso_proxy_application_id, 'enabled') | string | lower }}"
 {% set _sso_upstream_mode = (compose_mode_force | default('')) or DEPLOYMENT_MODE %}
 upstreams               =   "http://{{ ((sso_proxy_application_id | get_entity_name) ~ '_') if _sso_upstream_mode == 'swarm' else '' }}{{ lookup('sso', sso_proxy_application_id, 'oauth2_origin_host') }}:{{ lookup('sso', sso_proxy_application_id, 'oauth2_origin_port') }}"  # nocheck: literal-protocol-lookup  Internal docker upstream is plaintext by design.

roles/web-app-keycloak/vars/main.yml

@@ -56,10 +56,10 @@ KEYCLOAK_REALM_IMPORT_FILE_DOCKER: "{{ [KEYCLOAK_REALM_IMPORT_DIR_DOCKER,KEYCLOA
 KEYCLOAK_REALM_TOTP_ENABLED: "{{ lookup('config', application_id, 'services.keycloak.realm.totp_enabled') | bool }}"
 
 KEYCLOAK_BOOTSTRAP_ADMIN_USERNAME: "{{ lookup('config', application_id, 'services.keycloak.accounts.bootstrap.username') }}"
-KEYCLOAK_BOOTSTRAP_ADMIN_PASSWORD: "{{ lookup('config', application_id, 'credentials.administrator_password') }}"
+KEYCLOAK_BOOTSTRAP_ADMIN_PASSWORD: "{{ lookup('config', application_id, 'secrets.credentials.administrator_password') }}"
 
 KEYCLOAK_PERMANENT_ADMIN_USERNAME: "{{ lookup('config', application_id, 'services.keycloak.accounts.system.username') }}"
-KEYCLOAK_PERMANENT_ADMIN_PASSWORD: "{{ lookup('config', application_id, 'credentials.administrator_password') }}"
+KEYCLOAK_PERMANENT_ADMIN_PASSWORD: "{{ lookup('config', application_id, 'secrets.credentials.administrator_password') }}"
 
 KEYCLOAK_CONTAINER: "{{ lookup('config', application_id, 'services.keycloak.name') }}"
 KEYCLOAK_CONTAINER_ADDRESS: "{{ lookup('container_address', application_id, entity_name) }}"
@@ -115,8 +115,8 @@ KEYCLOAK_USER_EMAILS_VERIFIED: "{{ lookup('config', application_id, 'services.ke
 KEYCLOAK_MOODLE_ENABLED: "{{ 'web-app-moodle' in group_names }}"
 
 KEYCLOAK_RECAPTCHA_ENABLED: "{{ lookup('config', application_id, 'services.recaptcha.enabled') }}"
-KEYCLOAK_RECAPTCHA_KEY: "{{ lookup('config', application_id, 'credentials.recaptcha.key') }}"
-KEYCLOAK_RECAPTCHA_SECRET: "{{ lookup('config', application_id, 'credentials.recaptcha.secret') }}"
+KEYCLOAK_RECAPTCHA_KEY: "{{ lookup('config', application_id, 'secrets.credentials.recaptcha.key') }}"
+KEYCLOAK_RECAPTCHA_SECRET: "{{ lookup('config', application_id, 'secrets.credentials.recaptcha.secret') }}"
 
 KEYCLOAK_COMMAND_PERMANENT_ADMIN_LOGIN: |-
   {{ KEYCLOAK_EXEC_CONTAINER }} sh -lc '

roles/web-app-kix/vars/main.yml

@@ -15,7 +15,7 @@ KIX_FRONTEND_CONTAINER: "{{ lookup('config', application_id, 'services.' ~ KIX_F
 KIX_BACKEND_INTERNAL_PORT: "{{ lookup('config', application_id, 'services.' ~ KIX_BACKEND_SERVICE ~ '.ports.internal.http') }}"
 KIX_FRONTEND_INTERNAL_PORT: "{{ lookup('config', application_id, 'services.' ~ KIX_FRONTEND_SERVICE ~ '.ports.internal.http') }}"
 
-KIX_INITIAL_ADMIN_PW: "{{ lookup('config', application_id, 'credentials.kix_initial_admin_pw') }}"
+KIX_INITIAL_ADMIN_PW: "{{ lookup('config', application_id, 'secrets.credentials.kix_initial_admin_pw') }}"
 
 KIX_LDAP_ENABLED: "{{ lookup('config', application_id, 'services.ldap.enabled') | bool }}"
 KIX_LDAP_HOST: "{{ LDAP.SERVER.DOMAIN }}"

roles/web-app-lam/vars/main.yml

@@ -2,6 +2,5 @@
 # General
 application_id: "web-app-lam"
 
-# LAM specific
 LAM_CONTAINER: "{{ application_id | get_entity_name }}"
-LAM_PASSWORD: "{{ lookup('config', application_id, 'credentials.administrator_password') }}"
+LAM_PASSWORD: "{{ lookup('config', application_id, 'secrets.credentials.administrator_password') }}"

roles/web-app-listmonk/templates/env.j2

@@ -1,4 +1,4 @@
 {% include 'roles/sys-svc-container/templates/env.j2' %}
 
 LISTMONK_ADMIN_USER={{ lookup('config', application_id, 'users.administrator.username') }}
-LISTMONK_ADMIN_PASSWORD={{ lookup('config', application_id, 'credentials.administrator_password') | dotenv_quote }}
+LISTMONK_ADMIN_PASSWORD={{ lookup('config', application_id, 'secrets.credentials.administrator_password') | dotenv_quote }}

roles/web-app-listmonk/templates/playwright.env.j2

@@ -1,4 +1,4 @@
-ADMIN_NATIVE_PASSWORD={{ lookup('config', application_id, 'credentials.administrator_password') | dotenv_quote }}
+ADMIN_NATIVE_PASSWORD={{ lookup('config', application_id, 'secrets.credentials.administrator_password') | dotenv_quote }}
 
 ADMIN_PASSWORD={{ lookup('users', 'administrator').password | dotenv_quote }}
 

roles/web-app-listmonk/vars/main.yml

@@ -41,10 +41,10 @@ LISTMONK_SETTINGS:
     value: "true"
 
   - key: "security.captcha_key"
-    value: "\"{{ lookup('config', application_id, 'credentials.hcaptcha.key') }}\""
+    value: "\"{{ lookup('config', application_id, 'secrets.credentials.hcaptcha.key') }}\""
 
   - key: "security.captcha_secret"
-    value: "\"{{ lookup('config', application_id, 'credentials.hcaptcha.secret') }}\""
+    value: "\"{{ lookup('config', application_id, 'secrets.credentials.hcaptcha.secret') }}\""
 
   - key: "smtp"
     value: >-

roles/web-app-mailu/vars/main.yml

@@ -1,7 +1,7 @@
 ---
 application_id: "web-app-mailu"
 http_port: "{{ lookup('config', application_id, 'services.mailu.ports.local.http') }}"
-database_password: "{{ lookup('config', application_id, 'credentials.database_password') }}"
+database_password: "{{ lookup('config', application_id, 'secrets.credentials.database_password') }}"
 MAILU_VOLUMES_DIR: "{{ lookup('container', application_id, 'directories.volumes') }}"
 MAILU_INSTANCE_DIR: "{{ lookup('container', application_id, 'directories.instance') }}"
 MAILU_OVERRIDES_DIR: "{{ [ MAILU_VOLUMES_DIR, 'overrides' ] | path_join }}"
@@ -38,8 +38,8 @@ MAILU_SWARM_DB_ENGINE: "{{ lookup('database', application_id, 'type') }}"
 MAILU_SWARM_REDIS_HOST: "{{ lookup('engine', 'redis', application_id, 'host') }}"
 MAILU_IP4_PUBLIC: "{{ DOCKER_PUBLIC_BIND_HOST }}"
 MAILU_SUBNET: "{{ lookup('config', 'web-app-mailu', 'networks.local.subnet') }}"
-MAILU_SECRET_KEY: "{{ lookup('config', application_id, 'credentials.secret_key') }}"
-MAILU_API_TOKEN: "{{ lookup('config', application_id, 'credentials.api_token') }}"
+MAILU_SECRET_KEY: "{{ lookup('config', application_id, 'secrets.credentials.secret_key') }}"
+MAILU_API_TOKEN: "{{ lookup('config', application_id, 'secrets.credentials.api_token') }}"
 MAILU_OIDC_HOST: "{{ lookup('tls', 'web-app-keycloak', 'domain') }}"
 MAILU_OIDC_ENABLED: "{{ lookup('config', application_id, 'services.sso.enabled') }}"
 MAILU_OIDC_EMAIL_BY_USERNAME_ENABLED: "{{ lookup('config', application_id, 'services.sso.oidc.email_by_username') }}"

roles/web-app-mastodon/templates/env.j2

@@ -12,15 +12,15 @@ RAILS_LOG_LEVEL=debug
 DEBUG=*
 {% endif %}
 
-SECRET_KEY_BASE={{ lookup('config', application_id, 'credentials.secret_key_base') }}
-OTP_SECRET={{ lookup('config', application_id, 'credentials.otp_secret') }}
+SECRET_KEY_BASE={{ lookup('config', application_id, 'secrets.credentials.secret_key_base') }}
+OTP_SECRET={{ lookup('config', application_id, 'secrets.credentials.otp_secret') }}
 
-VAPID_PRIVATE_KEY={{ lookup('config', application_id, 'credentials.vapid_private_key') }}
-VAPID_PUBLIC_KEY={{ lookup('config', application_id, 'credentials.vapid_public_key') }}
+VAPID_PRIVATE_KEY={{ lookup('config', application_id, 'secrets.credentials.vapid_private_key') }}
+VAPID_PUBLIC_KEY={{ lookup('config', application_id, 'secrets.credentials.vapid_public_key') }}
 
-ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY={{ lookup('config', application_id, 'credentials.active_record_encryption_deterministic_key') }}
-ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT={{ lookup('config', application_id, 'credentials.active_record_encryption_key_derivation_salt') }}
-ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY={{ lookup('config', application_id, 'credentials.active_record_encryption_primary_key') }}
+ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY={{ lookup('config', application_id, 'secrets.credentials.active_record_encryption_deterministic_key') }}
+ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT={{ lookup('config', application_id, 'secrets.credentials.active_record_encryption_key_derivation_salt') }}
+ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY={{ lookup('config', application_id, 'secrets.credentials.active_record_encryption_primary_key') }}
 
 DB_HOST={{ lookup('database', application_id, 'host') }}
 DB_PORT={{ lookup('database', application_id, 'port') }}

roles/web-app-matrix/docs/Installation.md

@@ -18,7 +18,7 @@ For login with Token checkout the [Mautrix Slack authentication guide](https://d
 ### ChatGPT
 
 - Create API Token at [platform.openai.com](https://platform.openai.com/api-keys).
-- Set ``lookup('config', application_id, 'credentials.chatgpt_bridge_access_token')``
+- Set ``lookup('config', application_id, 'secrets.credentials.chatgpt_bridge_access_token')``
 
 ## Debug
 

roles/web-app-matrix/meta/addons/mautrix-meta.yml

@@ -11,4 +11,4 @@ config:
   bridge_name: "meta"
   database_username: "mautrix_meta_bridge"
   database_name: "mautrix_meta_bridge"
-  database_password: "{{ lookup('config', 'web-app-matrix', 'credentials.mautrix_meta_bridge_database_password') }}"
+  database_password: "{{ lookup('config', 'web-app-matrix', 'secrets.credentials.mautrix_meta_bridge_database_password') }}"

roles/web-app-matrix/meta/addons/mautrix-signal.yml

@@ -11,4 +11,4 @@ config:
   bridge_name: "signal"
   database_username: "mautrix_signal_bridge"
   database_name: "mautrix_signal_bridge"
-  database_password: "{{ lookup('config', 'web-app-matrix', 'credentials.mautrix_signal_bridge_database_password') }}"
+  database_password: "{{ lookup('config', 'web-app-matrix', 'secrets.credentials.mautrix_signal_bridge_database_password') }}"

roles/web-app-matrix/meta/addons/mautrix-slack.yml

@@ -11,4 +11,4 @@ config:
   bridge_name: "slack"
   database_username: "mautrix_slack_bridge"
   database_name: "mautrix_slack_bridge"
-  database_password: "{{ lookup('config', 'web-app-matrix', 'credentials.mautrix_slack_bridge_database_password') }}"
+  database_password: "{{ lookup('config', 'web-app-matrix', 'secrets.credentials.mautrix_slack_bridge_database_password') }}"

roles/web-app-matrix/meta/addons/mautrix-telegram.yml

@@ -11,4 +11,4 @@ config:
   bridge_name: "telegram"
   database_username: "mautrix_telegram_bridge"
   database_name: "mautrix_telegram_bridge"
-  database_password: "{{ lookup('config', 'web-app-matrix', 'credentials.mautrix_telegram_bridge_database_password') }}"
+  database_password: "{{ lookup('config', 'web-app-matrix', 'secrets.credentials.mautrix_telegram_bridge_database_password') }}"

roles/web-app-matrix/meta/addons/mautrix-whatsapp.yml

@@ -11,4 +11,4 @@ config:
   bridge_name: "whatsapp"
   database_username: "mautrix_whatsapp_bridge"
   database_name: "mautrix_whatsapp_bridge"
-  database_password: "{{ lookup('config', 'web-app-matrix', 'credentials.mautrix_whatsapp_bridge_database_password') }}"
+  database_password: "{{ lookup('config', 'web-app-matrix', 'secrets.credentials.mautrix_whatsapp_bridge_database_password') }}"

roles/web-app-matrix/tasks/flavor/compose/01_docker.yml

@@ -144,7 +144,7 @@
     container exec -i {{ MATRIX_SYNAPSE_CONTAINER_ADDRESS }}
     register_new_matrix_user
     -u chatgptbot
-    -p {{ lookup('config', application_id, 'credentials.chatgpt_bridge_user_password') | quote }}
+    -p {{ lookup('config', application_id, 'secrets.credentials.chatgpt_bridge_user_password') | quote }}
     -a -c {{ MATRIX_SYNAPSE_CONFIG_PATH_CONTAINER | quote }}
     http://localhost:{{ MATRIX_SYNAPSE_CONTAINER_PORT }}
   register: matrix_create_chatgptbot

roles/web-app-matrix/tasks/flavor/compose/main.yml

@@ -14,8 +14,8 @@
   set_fact:
     MATRIX_BRIDGES: "{{ MATRIX_BRIDGES | rejectattr('bridge_name', 'equalto', 'telegram') | list }}"
   when: >-
-    (lookup('config', application_id, 'credentials.mautrix_telgegram_bridge_api_id', '') | default('', true) | string | trim | length == 0)
-    or (lookup('config', application_id, 'credentials.mautrix_telgegram_bridge_api_pin', '') | default('', true) | string | trim | length == 0)
+    (lookup('config', application_id, 'secrets.credentials.mautrix_telgegram_bridge_api_id', '') | default('', true) | string | trim | length == 0)
+    or (lookup('config', application_id, 'secrets.credentials.mautrix_telgegram_bridge_api_pin', '') | default('', true) | string | trim | length == 0)
   changed_when: false
 
 - name: "🐳 compose-flavor: docker stack for '{{ application_id }}'"

roles/web-app-matrix/templates/flavor/ansible/vars.yml.j2

@@ -7,8 +7,8 @@ matrix_homeserver_implementation: synapse
 matrix_playbook_docker_installation_enabled: false
 matrix_playbook_migration_validated_version: "{{ MATRIX_MDAD_MIGRATION_VALIDATED_VERSION }}"
 
-matrix_synapse_macaroon_secret_key: "{{ lookup('config', application_id, 'credentials.macaroon_secret_key') }}"
-matrix_homeserver_generic_secret_key: "{{ lookup('config', application_id, 'credentials.macaroon_secret_key') }}"
+matrix_synapse_macaroon_secret_key: "{{ lookup('config', application_id, 'secrets.credentials.macaroon_secret_key') }}"
+matrix_homeserver_generic_secret_key: "{{ lookup('config', application_id, 'secrets.credentials.macaroon_secret_key') }}"
 
 matrix_synapse_rc_login:
   address:

roles/web-app-matrix/templates/flavor/compose/mautrix/meta.config.yml.j2

@@ -95,7 +95,7 @@ bridge:
 
 database:
     type: postgres
-    uri: postgres://mautrix_meta_bridge:{{ lookup('config', application_id, 'credentials.mautrix_meta_bridge_database_password') | regex_replace('/', '%2F') | regex_replace('@', '%40') | regex_replace(':', '%3A') }}@{{ MATRIX_POSTGRES_HOST }}/mautrix_meta_bridge?sslmode=disable
+    uri: postgres://mautrix_meta_bridge:{{ lookup('config', application_id, 'secrets.credentials.mautrix_meta_bridge_database_password') | regex_replace('/', '%2F') | regex_replace('@', '%40') | regex_replace(':', '%3A') }}@{{ MATRIX_POSTGRES_HOST }}/mautrix_meta_bridge?sslmode=disable
     max_open_conns: 20
     max_idle_conns: 2
     max_conn_idle_time: null

roles/web-app-matrix/templates/flavor/compose/mautrix/signal.config.yml.j2

@@ -27,7 +27,7 @@ bridge:
 
 database:
     type: postgres
-    uri: postgres://mautrix_signal_bridge:{{ lookup('config', application_id, 'credentials.mautrix_signal_bridge_database_password') | regex_replace('/', '%2F') | regex_replace('@', '%40') | regex_replace(':', '%3A') }}@{{ MATRIX_POSTGRES_HOST }}/mautrix_signal_bridge?sslmode=disable
+    uri: postgres://mautrix_signal_bridge:{{ lookup('config', application_id, 'secrets.credentials.mautrix_signal_bridge_database_password') | regex_replace('/', '%2F') | regex_replace('@', '%40') | regex_replace(':', '%3A') }}@{{ MATRIX_POSTGRES_HOST }}/mautrix_signal_bridge?sslmode=disable
     max_open_conns: 20
     max_idle_conns: 2
     max_conn_idle_time: null

roles/web-app-matrix/templates/flavor/compose/mautrix/slack.config.yml.j2

@@ -1,7 +1,7 @@
 
 database:
     type: postgres
-    uri: postgres://mautrix_slack_bridge:{{ lookup('config', application_id, 'credentials.mautrix_slack_bridge_database_password') | regex_replace('/', '%2F') | regex_replace('@', '%40') | regex_replace(':', '%3A') }}@{{ MATRIX_POSTGRES_HOST }}/mautrix_slack_bridge?sslmode=disable
+    uri: postgres://mautrix_slack_bridge:{{ lookup('config', application_id, 'secrets.credentials.mautrix_slack_bridge_database_password') | regex_replace('/', '%2F') | regex_replace('@', '%40') | regex_replace(':', '%3A') }}@{{ MATRIX_POSTGRES_HOST }}/mautrix_slack_bridge?sslmode=disable
     max_open_conns: 20
     max_idle_conns: 2
     max_conn_idle_time: null

roles/web-app-matrix/templates/flavor/compose/mautrix/telegram.config.yml.j2

@@ -47,7 +47,7 @@ bridge:
 
 database:
     type: postgres
-    uri: postgres://mautrix_telegram_bridge:{{ lookup('config', application_id, 'credentials.mautrix_telegram_bridge_database_password') | regex_replace('/', '%2F') | regex_replace('@', '%40') | regex_replace(':', '%3A') }}@{{ MATRIX_POSTGRES_HOST }}/mautrix_telegram_bridge?sslmode=disable
+    uri: postgres://mautrix_telegram_bridge:{{ lookup('config', application_id, 'secrets.credentials.mautrix_telegram_bridge_database_password') | regex_replace('/', '%2F') | regex_replace('@', '%40') | regex_replace(':', '%3A') }}@{{ MATRIX_POSTGRES_HOST }}/mautrix_telegram_bridge?sslmode=disable
     max_open_conns: 5
     max_idle_conns: 1
     max_conn_idle_time: null
@@ -129,8 +129,8 @@ encryption:
         disable_device_change_key_rotation: false
 
 network:
-    api_id: {{ lookup('config', application_id, 'credentials.mautrix_telgegram_bridge_api_id') }}
-    api_hash: {{ lookup('config', application_id, 'credentials.mautrix_telgegram_bridge_api_pin') }}
+    api_id: {{ lookup('config', application_id, 'secrets.credentials.mautrix_telgegram_bridge_api_id') }}
+    api_hash: {{ lookup('config', application_id, 'secrets.credentials.mautrix_telgegram_bridge_api_pin') }}
 
     device_info:
         device_model: mautrix-telegram

roles/web-app-matrix/templates/flavor/compose/mautrix/whatsapp.config.yml.j2

@@ -118,7 +118,7 @@ bridge:
 
 database:
     type: postgres
-    uri: postgres://mautrix_whatsapp_bridge:{{ lookup('config', application_id, 'credentials.mautrix_whatsapp_bridge_database_password') | regex_replace('/', '%2F') | regex_replace('@', '%40') | regex_replace(':', '%3A') }}@{{ MATRIX_POSTGRES_HOST }}/mautrix_whatsapp_bridge?sslmode=disable
+    uri: postgres://mautrix_whatsapp_bridge:{{ lookup('config', application_id, 'secrets.credentials.mautrix_whatsapp_bridge_database_password') | regex_replace('/', '%2F') | regex_replace('@', '%40') | regex_replace(':', '%3A') }}@{{ MATRIX_POSTGRES_HOST }}/mautrix_whatsapp_bridge?sslmode=disable
     max_open_conns: 20
     max_idle_conns: 2
     max_conn_idle_time: null

roles/web-app-matrix/templates/flavor/compose/services.yml.j2

@@ -67,7 +67,7 @@
     {{ lookup('container_image', application_id, 'matrix-chatgpt-bot') }}
     {{ lookup('container_volumes', application_id, service_name) | indent(4) }}
     environment:
-      OPENAI_API_KEY: "{{ lookup('config', application_id, 'credentials.chatgpt_bridge_openai_api_key')}}"
+      OPENAI_API_KEY: "{{ lookup('config', application_id, 'secrets.credentials.chatgpt_bridge_openai_api_key')}}"
       CHATGPT_CONTEXT: 'thread'
       CHATGPT_API_MODEL: 'gpt-3.5-turbo'
       CHATGPT_REVERSE_PROXY: 'https://api.openai.com/v1/chat/completions'
@@ -78,8 +78,8 @@
       KEYV_BOT_STORAGE: 'true'
       MATRIX_HOMESERVER_URL: '{{ MATRIX_SYNAPSE_URL }}'
       MATRIX_BOT_USERNAME: '@chatgptbot:{{ MATRIX_SERVER_NAME }}'
-      MATRIX_ACCESS_TOKEN: "{{ lookup('config', application_id, 'credentials.chatgpt_bridge_access_token', '') }}"
-      MATRIX_BOT_PASSWORD: "{{ lookup('config', application_id, 'credentials.chatgpt_bridge_user_password') }}"
+      MATRIX_ACCESS_TOKEN: "{{ lookup('config', application_id, 'secrets.credentials.chatgpt_bridge_access_token', '') }}"
+      MATRIX_BOT_PASSWORD: "{{ lookup('config', application_id, 'secrets.credentials.chatgpt_bridge_user_password') }}"
       MATRIX_DEFAULT_PREFIX: '!chatgpt'
       MATRIX_DEFAULT_PREFIX_REPLY: 'false'
       MATRIX_WHITELIST: ':{{ MATRIX_SERVER_NAME }}'

roles/web-app-matrix/templates/flavor/compose/synapse/homeserver.yaml.j2

@@ -28,8 +28,8 @@ media_store_path:               "/data/media_store"
 registration_shared_secret:     "{{ MATRIX_REGISTRATION_SHARED_SECRET }}"
 report_stats:                   true
 enable_metrics:                 {{ lookup('config', application_id, 'services.prometheus.native_metrics.enabled', False) | bool | lower }}
-macaroon_secret_key:            "{{ lookup('config', application_id, 'credentials.macaroon_secret_key') }}"
-form_secret:                    "{{ lookup('config', application_id, 'credentials.form_secret') }}"
+macaroon_secret_key:            "{{ lookup('config', application_id, 'secrets.credentials.macaroon_secret_key') }}"
+form_secret:                    "{{ lookup('config', application_id, 'secrets.credentials.form_secret') }}"
 signing_key_path:               "/data/{{ MATRIX_SYNAPSE_DOMAIN }}.signing.key"
 web_client_location:            "{{ lookup('tls', application_id, 'protocols.web') }}://{{ lookup('domains', application_id).element }}"
 public_baseurl:                 "{{ MATRIX_SYNAPSE_URL }}"
@@ -44,8 +44,6 @@ email:
   smtp_port:                    "{{ email.port }}"
   smtp_user:                    "{{ email.username }}"
   smtp_pass:                    "{{ email.password }}"
-  #force_tls:                    true
-  #require_transport_security:   true
   enable_tls:                   "{{ email.tls | upper }}"
   notif_from:                   "Your Friendly %(app)s homeserver <{{ email['from'] }}>"
   app_name:                     "Matrix on {{ MATRIX_SYNAPSE_DOMAIN }}"
@@ -56,7 +54,6 @@ email:
 {% endif %}
 
 {% if MATRIX_OIDC_ENABLED | bool %}
-# @See https://matrix-org.github.io/synapse/latest/openid.html
 oidc_providers:
   - idp_id:         keycloak
     idp_name:       "{{ OIDC.BUTTON_TEXT }}"

roles/web-app-matrix/vars/main.yml

@@ -13,7 +13,7 @@ MATRIX_ADMINISTRATOR_PASSWORD: "{{ lookup('users', 'administrator').password }}"
 MATRIX_WELL_KNOWN_DIRECTORY: "{{ [ lookup('nginx','directories.data.well_known'), 'matrix' ] | path_join }}"
 MATRIX_WELL_KNOWN_FILE: "{{ MATRIX_WELL_KNOWN_DIRECTORY }}server"
 MATRIX_REGISTRATION_FILE_FOLDER: "/data/"
-MATRIX_REGISTRATION_SHARED_SECRET: "{{ lookup('config', application_id, 'credentials.registration_shared_secret') }}"
+MATRIX_REGISTRATION_SHARED_SECRET: "{{ lookup('config', application_id, 'secrets.credentials.registration_shared_secret') }}"
 MATRIX_FEDERATION_PORT: "{{ lookup('config', 'web-app-matrix', 'services.synapse.ports.public.federation') }}"
 MATRIX_OIDC_ENABLED: "{{ lookup('config', application_id, 'services.sso.enabled') }}"
 MATRIX_OIDC_HOST: "{{ lookup('tls', 'web-app-keycloak', 'domain') }}"
@@ -83,7 +83,7 @@ MATRIX_COTURN_SHARED: "{{ lookup('config', application_id, 'services.coturn.shar
 MATRIX_COTURN_HOST: "{{ lookup('domain', 'web-svc-coturn') if MATRIX_COTURN_SHARED else '' }}"
 MATRIX_COTURN_STUN_TURN_PORT: "{{ lookup('config', 'web-svc-coturn', 'services.coturn.ports.public.stun_turn') if MATRIX_COTURN_SHARED else '' }}"
 MATRIX_COTURN_STUN_TURN_TLS_PORT: "{{ lookup('config', 'web-svc-coturn', 'services.coturn.ports.public.stun_turn_tls') if MATRIX_COTURN_SHARED else '' }}"
-MATRIX_COTURN_AUTH_SECRET: "{{ lookup('config', 'web-svc-coturn', 'credentials.auth_secret') if MATRIX_COTURN_SHARED else '' }}"
+MATRIX_COTURN_AUTH_SECRET: "{{ lookup('config', 'web-svc-coturn', 'secrets.credentials.auth_secret') if MATRIX_COTURN_SHARED else '' }}"
 
 MATRIX_OUTBOUND_MAIL_ENABLED: "{{ lookup('config', application_id, 'services.email.enabled') | bool }}"
 MATRIX_OUTBOUND_MAIL: "{{ lookup('email', application_id) if MATRIX_OUTBOUND_MAIL_ENABLED else {} }}"

roles/web-app-mediawiki/vars/main.yml

@@ -27,8 +27,8 @@ MEDIAWIKI_USER_GID: "33"
 MEDIAWIKI_NETWORK_DATABASE: "{{ lookup('database', application_id, 'network') }}"
 
 MEDIAWIKI_ADMINISTRATOR_NAME: "{{ lookup('users', 'administrator').username }}"
-MEDIAWIKI_ADMINISTRATOR_PASSWORD: "{{ lookup('config', application_id, 'credentials.administrator_password') }}"
-MEDIAWIKI_SECRET_KEY: "{{ lookup('config', application_id, 'credentials.secret_key') }}"
+MEDIAWIKI_ADMINISTRATOR_PASSWORD: "{{ lookup('config', application_id, 'secrets.credentials.administrator_password') }}"
+MEDIAWIKI_SECRET_KEY: "{{ lookup('config', application_id, 'secrets.credentials.secret_key') }}"
 
 MEDIAWIKI_OIDC_ENABLED: "{{ lookup('config', application_id, 'services.sso.enabled') }}"
 MEDIAWIKI_OIDC_CLIENT_ID: "{{ OIDC.CLIENT.ID }}"

roles/web-app-mobilizon/templates/env.j2

@@ -30,9 +30,9 @@ MOBILIZON_DATABASE_PORT={{ lookup('database', application_id, 'port') }}
 DATABASE_POOL_SIZE={{ POSTGRES_ALLOWED_AVG_CONNECTIONS }}
 POOL_SIZE={{ POSTGRES_ALLOWED_AVG_CONNECTIONS }}
 
-MOBILIZON_INSTANCE_SECRET_KEY_BASE={{ lookup('config', application_id, 'credentials.secret_key_base') }}
+MOBILIZON_INSTANCE_SECRET_KEY_BASE={{ lookup('config', application_id, 'secrets.credentials.secret_key_base') }}
 
-MOBILIZON_INSTANCE_SECRET_KEY={{ lookup('config', application_id, 'credentials.secret_key') }}
+MOBILIZON_INSTANCE_SECRET_KEY={{ lookup('config', application_id, 'secrets.credentials.secret_key') }}
 
 {% if email.enabled | bool %}
 MOBILIZON_SMTP_SERVER={{ email.host }}

roles/web-app-moodle/tasks/01_manager_ops.yml

@@ -32,7 +32,7 @@
     php {{ MOODLE_CLI_DIR }}/install_database.php
     --agree-license
     --adminuser={{ lookup('config', application_id, 'users.administrator.username') }}
-    --adminpass={{ lookup('config', application_id, 'credentials.user_password') | quote }}
+    --adminpass={{ lookup('config', application_id, 'secrets.credentials.user_password') | quote }}
     --adminemail={{ lookup('config', application_id, 'users.administrator.email') }}
     --fullname="{{ MOODLE_SITE_TITLE }}"
     --shortname=Academy

roles/web-app-moodle/templates/playwright.env.j2

@@ -4,7 +4,7 @@ MOODLE_OIDC_SCOPE_NAME={{ MOODLE_OIDC_CUSTOM_SCOPE | dotenv_quote }}
 OIDC_CLIENT_ID={{ OIDC.CLIENT.ID | dotenv_quote }}
 {% if lookup('config', application_id, 'services.lam.enabled', false) | bool %}
 LAM_BASE_URL={{ lookup('tls', 'web-app-lam', 'url.base') | dotenv_quote }}
-LAM_PASSWORD={{ lookup('config', 'web-app-lam', 'credentials.administrator_password') | dotenv_quote }}
+LAM_PASSWORD={{ lookup('config', 'web-app-lam', 'secrets.credentials.administrator_password') | dotenv_quote }}
 LAM_OAUTH2_FRONTED={{ lookup('sso', 'web-app-lam', 'is_proxy_gated') | string | lower }}
 LDAP_ADMIN_PASSWORD={{ LDAP.BIND_CREDENTIAL | dotenv_quote }}
 {% endif %}

roles/web-app-n8n/vars/main.yml

@@ -8,8 +8,8 @@ N8N_INTERNAL_PORT: "{{ lookup('config', application_id, 'services.n8n.ports.inte
 
 N8N_HOSTNAME: "{{ lookup('domain', application_id) }}"
 N8N_WEB_PROTOCOL: "{{ lookup('tls', application_id, 'protocols.web') }}"
-N8N_ENCRYPTION_KEY: "{{ lookup('config', application_id, 'credentials.encryption_key') }}"
-N8N_OWNER_PASSWORD: "{{ lookup('config', application_id, 'credentials.owner_password') }}"
+N8N_ENCRYPTION_KEY: "{{ lookup('config', application_id, 'secrets.credentials.encryption_key') }}"
+N8N_OWNER_PASSWORD: "{{ lookup('config', application_id, 'secrets.credentials.owner_password') }}"
 
 N8N_INTERNAL_API_URL: "http://{{ DOCKER_REACH_HOST }}:{{ N8N_HTTP_PORT }}"
 

roles/web-app-nextcloud/meta/addons/bbb.yml

@@ -13,7 +13,7 @@ config:
   plugin_configuration:
     - appid: "bbb"
       configkey: "api.secret"
-      configvalue: "{{ lookup('config','web-app-bigbluebutton', 'credentials.shared_secret', '') }}"
+      configvalue: "{{ lookup('config','web-app-bigbluebutton', 'secrets.credentials.shared_secret', '') }}"
     - appid: "bbb"
       configkey: "api.url"
       configvalue: "{{ lookup('tls', 'web-app-bigbluebutton', 'url.base') }}{{ lookup('config', 'web-app-bigbluebutton', 'services.bigbluebutton.api_suffix','') }}"

roles/web-app-nextcloud/meta/addons/onlyoffice.yml

@@ -25,7 +25,7 @@ config:
       configvalue: "{{ NEXTCLOUD_URL }}/"
     - appid: "onlyoffice"
       configkey: "jwt_secret"
-      configvalue: "{{ lookup('config','web-svc-onlyoffice', 'credentials.onlyoffice_jwt_secret', '') }}"
+      configvalue: "{{ lookup('config','web-svc-onlyoffice', 'secrets.credentials.onlyoffice_jwt_secret', '') }}"
     - appid: "onlyoffice"
       configkey: "jwt_header"
       configvalue: "Authorization"

roles/web-app-nextcloud/tasks/addons/integration_openai.yml

@@ -12,7 +12,7 @@
 
 - name: 🔍 Resolve Flowise LiteLLM master key for integration_openai api_key
   set_fact:
-    nextcloud_openai_flowise_api_key: "{{ lookup('config', 'web-app-flowise', 'credentials.llm_master_key', '') }}"
+    nextcloud_openai_flowise_api_key: "{{ lookup('config', 'web-app-flowise', 'secrets.credentials.llm_master_key', '') }}"
   changed_when: false
   no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
   when: nextcloud_openai_use_flowise | bool

roles/web-app-nextcloud/templates/playwright.env.j2

@@ -29,7 +29,7 @@ MOODLE_BASE_URL={{ (lookup('tls', 'web-app-moodle', 'url.base') if (lookup('conf
 
 NEXTCLOUD_BASE_URL={{ lookup('tls', 'web-app-nextcloud', 'url.base') | dotenv_quote }}
 
-NEXTCLOUD_DIRECT_LOGIN_PASSWORD={{ lookup('config', application_id, 'credentials.administrator_password') | dotenv_quote }}
+NEXTCLOUD_DIRECT_LOGIN_PASSWORD={{ lookup('config', application_id, 'secrets.credentials.administrator_password') | dotenv_quote }}
 
 NEXTCLOUD_ONLYOFFICE_EXPECTED_DOCUMENT_SERVER_URL={{ NEXTCLOUD_ONLYOFFICE_URL | dotenv_quote }}
 

roles/web-app-nextcloud/vars/main.yml

@@ -5,7 +5,7 @@ entity_name: "{{ application_id | get_entity_name }}"
 
 swarm_stack_converge_retries: 600
 
-database_password: "{{ lookup('config', application_id, 'credentials.database_password') }}" # nocheck: lookup-config-path
+database_password: "{{ lookup('config', application_id, 'secrets.credentials.database_password') }}" # nocheck: lookup-config-path
 
 NEXTCLOUD_DOMAIN: "{{ lookup('domain',application_id) }}"
 NEXTCLOUD_PORT: "{{ lookup('config', application_id, 'services.nextcloud.ports.local.http') }}"
@@ -31,7 +31,7 @@ NEXTCLOUD_DOCKER_WORK_DIRECTORY: "/var/www/html/"
 NEXTCLOUD_DOCKER_CONF_ADD_PATH: "/var/www/infinito/"
 NEXTCLOUD_DOCKER_CONF_LOADER_PATH: "{{ [ NEXTCLOUD_DOCKER_WORK_DIRECTORY, 'config/zzz-infinito.config.php'] | path_join }}"
 
-NEXTCLOUD_ADMINISTRATOR_PASSWORD: "{{ lookup('config', application_id, 'credentials.administrator_password') }}"
+NEXTCLOUD_ADMINISTRATOR_PASSWORD: "{{ lookup('config', application_id, 'secrets.credentials.administrator_password') }}"
 NEXTCLOUD_ADMINISTRATOR_USERNAME: "{{ lookup('config', application_id, 'users.administrator.username') }}"
 
 NEXTCLOUD_INIT_GATE_FILE: "nextcloud-init-gate.sh"
@@ -65,10 +65,10 @@ NEXTCLOUD_HPB_SERVICE: "talk"
 NEXTCLOUD_HPB_CONTAINER: "{{ lookup('config', application_id, 'services.' ~ NEXTCLOUD_HPB_SERVICE ~ '.name') }}"
 NEXTCLOUD_HPB_NETWORK_MODE: "{{ lookup('config', application_id, 'services.' ~ NEXTCLOUD_HPB_SERVICE ~ '.network_mode') }}"
 NEXTCLOUD_HPB_PLUGIN_ENABLED: "{{ lookup('config', application_id, 'addons.spreed.enabled') }}"
-NEXTCLOUD_HPB_INTERNAL_SECRET: "{{ lookup('config', application_id, 'credentials.talk_internal_secret') }}"
+NEXTCLOUD_HPB_INTERNAL_SECRET: "{{ lookup('config', application_id, 'secrets.credentials.talk_internal_secret') }}"
 NEXTCLOUD_HPB_DOMAIN: "{{ NEXTCLOUD_DOMAIN }}"
 
-NEXTCLOUD_HPB_SIGNALING_SECRET: "{{ lookup('config', application_id, 'credentials.talk_signaling_secret') }}"
+NEXTCLOUD_HPB_SIGNALING_SECRET: "{{ lookup('config', application_id, 'secrets.credentials.talk_signaling_secret') }}"
 NEXTCLOUD_HPB_SIGNALING_LOCATION: "/standalone-signaling/"
 NEXTCLOUD_HPB_SIGNALING_PORT: "{{ lookup('config', application_id, 'services.talk.ports.internal.signaling') }}"
 NEXTCLOUD_HPB_SIGNALING_URL: "{{ [ NEXTCLOUD_URL, NEXTCLOUD_HPB_SIGNALING_LOCATION ] | url_join }}"
@@ -79,7 +79,7 @@ NEXTCLOUD_HPB_TURN_ONBOARD_PORT: "{{ lookup('config', application_id, 'services.
 NEXTCLOUD_HPB_TURN_ONBOARD_BIND_HOST: "{{ DOCKER_PUBLIC_BIND_HOST }}"
 NEXTCLOUD_HPB_TURN_ONBOARD_ENABLED: "{{ lookup('config', application_id, 'services.' ~ NEXTCLOUD_HPB_SERVICE ~ '.turn_server.onboard_enabled') if NEXTCLOUD_HPB_PLUGIN_ENABLED
   else false }}"
-NEXTCLOUD_HPB_TURN_ONBOARD_SECRET: "{{ lookup('config', application_id, 'credentials.talk_turn_secret') }}"
+NEXTCLOUD_HPB_TURN_ONBOARD_SECRET: "{{ lookup('config', application_id, 'secrets.credentials.talk_turn_secret') }}"
 NEXTCLOUD_HPB_TURN_ONBOARD_PUBLISH_PORTS: "{{ not DOCKER_IN_CONTAINER | bool }}"
 NEXTCLOUD_HPB_TURN_ONBOARD_RELAY_PORT_START: "{{ lookup('config', application_id, 'services.nextcloud.ports.public.relay.start') }}"
 NEXTCLOUD_HPB_TURN_ONBOARD_RELAY_PORT_END: "{{ lookup('config', application_id, 'services.nextcloud.ports.public.relay.end') }}"
@@ -96,7 +96,7 @@ NEXTCLOUD_HPB_TURN_ONBOARD_CONFIG: >-
 
 NEXTCLOUD_HPB_TURN_STANDALONE_ROLE: "web-svc-coturn"
 NEXTCLOUD_HPB_TURN_STANDALONE_PORT: "{{ lookup('config', NEXTCLOUD_HPB_TURN_STANDALONE_ROLE, 'services.coturn.ports.public.stun_turn') }}"
-NEXTCLOUD_HPB_TURN_STANDALONE_SECRET: "{{ lookup('config',NEXTCLOUD_HPB_TURN_STANDALONE_ROLE, 'credentials.auth_secret') }}"
+NEXTCLOUD_HPB_TURN_STANDALONE_SECRET: "{{ lookup('config',NEXTCLOUD_HPB_TURN_STANDALONE_ROLE, 'secrets.credentials.auth_secret') }}"
 NEXTCLOUD_HPB_TURN_STANDALONE_ENABLED: "{{ lookup('config', application_id, 'services.talk.turn_server.standalone_enabled') if NEXTCLOUD_HPB_PLUGIN_ENABLED else false
   }}"
 NEXTCLOUD_HPB_TURN_STANDALONE_DOMAIN: "{{ lookup('domain',NEXTCLOUD_HPB_TURN_STANDALONE_ROLE) }}"
@@ -138,7 +138,7 @@ NEXTCLOUD_WHITEBOARD_IMAGE: "{{ lookup('config', application_id, 'services.' ~ N
 NEXTCLOUD_WHITEBOARD_VERSION: "{{ lookup('config', application_id, 'services.' ~ NEXTCLOUD_WHITEBOARD_SERVICE ~'.version') }}"
 NEXTCLOUD_WHITEBOARD_ENABLED: "{{ lookup('config', application_id, 'addons.' ~ NEXTCLOUD_WHITEBOARD_SERVICE ~'.enabled') }}"
 NEXTCLOUD_WHITEBOARD_PORT_INTERNAL: "{{ lookup('config', application_id, 'services.' ~ NEXTCLOUD_WHITEBOARD_SERVICE ~ '.ports.internal.http') }}"
-NEXTCLOUD_WHITEBOARD_JWT: "{{ lookup('config', application_id, 'credentials.' ~ NEXTCLOUD_WHITEBOARD_SERVICE ~'_jwt_secret') }}"
+NEXTCLOUD_WHITEBOARD_JWT: "{{ lookup('config', application_id, 'secrets.credentials.' ~ NEXTCLOUD_WHITEBOARD_SERVICE ~'_jwt_secret') }}"
 NEXTCLOUD_WHITEBOARD_LOCATION: "/whiteboard/"
 NEXTCLOUD_WHITEBOARD_URL: "{{ [ NEXTCLOUD_URL, NEXTCLOUD_WHITEBOARD_LOCATION ] | url_join }}"
 NEXTCLOUD_WHITEBOARD_TMP_VOLUME: "{{ lookup('volume', application_id, 'whiteboard_tmp').name }}"
@@ -151,7 +151,7 @@ NEXTCLOUD_RECORDING_SERVICE: "talk_recording"
 NEXTCLOUD_RECORDING_CONTAINER: "{{ lookup('config', application_id, 'services.' ~ NEXTCLOUD_RECORDING_SERVICE ~ '.name') }}"
 NEXTCLOUD_RECORDING_ENABLED: "{{ NEXTCLOUD_HPB_PLUGIN_ENABLED }}"
 NEXTCLOUD_RECORDING_PORT: "{{ lookup('config', application_id, 'services.talk_recording.ports.internal.recording') }}"
-NEXTCLOUD_RECORDING_SECRET: "{{ lookup('config', application_id, 'credentials.talk_recording_secret') }}"
+NEXTCLOUD_RECORDING_SECRET: "{{ lookup('config', application_id, 'secrets.credentials.talk_recording_secret') }}"
 NEXTCLOUD_RECORDING_TMP_VOLUME: "{{ lookup('volume', application_id, 'talk_recording_tmp').name }}"
 
 NEXTCLOUD_COLLABORA_URL: "{{ lookup('tls', 'web-svc-collabora', 'url.base') }}"

roles/web-app-odoo/vars/main.yml

@@ -34,7 +34,7 @@ ODOO_ADMINISTRATOR_USERNAME: "{{ lookup('users', 'administrator').username }}"
 ODOO_ADMINISTRATOR_PASSWORD: "{{ lookup('users', 'administrator').password }}"
 ODOO_ADMINISTRATOR_EMAIL: "{{ lookup('users', 'administrator').email }}"
 
-ODOO_MASTER_PASSWORD: "{{ lookup('config', application_id, 'credentials.master_password') }}"
+ODOO_MASTER_PASSWORD: "{{ lookup('config', application_id, 'secrets.credentials.master_password') }}"
 
 ODOO_MODULES_CORE: "{{ lookup('config', application_id, 'addons') | dict2items | selectattr('value.group','equalto','core') | map(attribute='key') | list }}"
 ODOO_MODULES_OPTIONAL: "{{ lookup('config', application_id, 'addons') | dict2items | selectattr('value.group','equalto','optional') | map(attribute='key') | list

roles/web-app-opencloud/vars/main.yml

@@ -2,7 +2,6 @@
 application_id: "web-app-opencloud"
 entity_name: "{{ application_id | get_entity_name }}"
 
-# OpenCloud's proxy unconditionally 308-redirects non-https X-Forwarded-Proto.
 proxy_x_forwarded_proto: "https"
 
 OPENCLOUD_CONTAINER: "{{ lookup('config', application_id, 'services.opencloud.name') }}"
@@ -13,12 +12,12 @@ OPENCLOUD_DOMAIN: "{{ lookup('domain', application_id) }}"
 OPENCLOUD_OIDC_ENABLED: "{{ lookup('config', application_id, 'services.sso.enabled') }}"
 OPENCLOUD_LDAP_ENABLED: "{{ lookup('config', application_id, 'services.ldap.enabled') }}"
 
-OPENCLOUD_ADMIN_PASSWORD: "{{ lookup('config', application_id, 'credentials.administrator_password') }}"
+OPENCLOUD_ADMIN_PASSWORD: "{{ lookup('config', application_id, 'secrets.credentials.administrator_password') }}"
 
-OPENCLOUD_MACHINE_AUTH_API_KEY: "{{ lookup('config', application_id, 'credentials.machine_auth_api_key') }}"
-OPENCLOUD_STORAGE_SYSTEM_JWT_SECRET: "{{ lookup('config', application_id, 'credentials.storage_system_jwt_secret') }}"
-OPENCLOUD_JWT_SECRET: "{{ lookup('config', application_id, 'credentials.jwt_secret') }}"
-OPENCLOUD_TRANSFER_SECRET: "{{ lookup('config', application_id, 'credentials.transfer_secret') }}"
+OPENCLOUD_MACHINE_AUTH_API_KEY: "{{ lookup('config', application_id, 'secrets.credentials.machine_auth_api_key') }}"
+OPENCLOUD_STORAGE_SYSTEM_JWT_SECRET: "{{ lookup('config', application_id, 'secrets.credentials.storage_system_jwt_secret') }}"
+OPENCLOUD_JWT_SECRET: "{{ lookup('config', application_id, 'secrets.credentials.jwt_secret') }}"
+OPENCLOUD_TRANSFER_SECRET: "{{ lookup('config', application_id, 'secrets.credentials.transfer_secret') }}"
 
 # Exception: the tls lookup raises when web-app-opentalk is not in scope
 OPENCLOUD_OPENTALK_ENABLED: "{{ ('web-app-opentalk' in group_names) | lower }}"

roles/web-app-openproject/templates/env.j2

@@ -4,7 +4,7 @@ OPENPROJECT_HTTPS={{ lookup('tls', application_id, 'enabled') | string | lower }
 OPENPROJECT_HOST__NAME={{ lookup('domain',application_id) }}
 OPENPROJECT_RAILS__RELATIVE__URL__ROOT=
 IMAP_ENABLED=false
-SECRET_KEY_BASE={{ lookup('config', application_id, 'credentials.secret_key_base') }}
+SECRET_KEY_BASE={{ lookup('config', application_id, 'secrets.credentials.secret_key_base') }}
 OPENPROJECT_HSTS={{ lookup('tls', application_id, 'enabled') | string | lower }}
 RAILS_CACHE_STORE=memcache
 OPENPROJECT_CACHE__MEMCACHE__SERVER=cache:11211

roles/web-app-openproject/templates/proxy.conf.j2

@@ -16,7 +16,7 @@ server
   {% if lookup('sso', application_id, 'is_proxy_gated') %}
     {% set sso_proxy_enabled = true %}
     {% set webserver_location_extra_configuration %}
-  proxy_set_header X-Remote-User "${authrequest_username}:{{ lookup('config', application_id, 'credentials.auth_source_sso_secret') }}";
+  proxy_set_header X-Remote-User "${authrequest_username}:{{ lookup('config', application_id, 'secrets.credentials.auth_source_sso_secret') }}";
     {% endset %}
     {% set location = '/' %}
     {% include 'roles/sys-svc-proxy/templates/location/html.conf.j2' %}

roles/web-app-openproject/vars/main.yml

@@ -23,7 +23,6 @@ OPENPROJECT_CACHE_CONTAINER: "{{ lookup('config', application_id, 'services.cach
 
 OPENPROJECT_PLUGINS_FOLDER: "{{ lookup('container', application_id, 'directories.volumes') }}plugins/"
 
-# The following volume doesn't have a practcical function. It just exist to prevent the creation of unnecessary anonymous volumes
 OPENPROJECT_DUMMY_DIR: "{{ lookup('container', application_id, 'directories.volumes') }}dummy_volume"
 
 OPENPROJECT_EMAIL: "{{ lookup('email', application_id) }}"
@@ -35,21 +34,16 @@ OPENPROJECT_RAILS_SETTINGS:
   smtp_password: "{{ OPENPROJECT_EMAIL.password }}"
   smtp_ssl: false
 
-# Auth integrations
 OPENPROJECT_SSO_PROXY_GATED: "{{ lookup('sso', application_id, 'is_proxy_gated') }}"
 OPENPROJECT_SSO_HEADER: "X-Remote-User"
-OPENPROJECT_SSO_SECRET: "{{ lookup('config', application_id, 'credentials.auth_source_sso_secret') }}"
+OPENPROJECT_SSO_SECRET: "{{ lookup('config', application_id, 'secrets.credentials.auth_source_sso_secret') }}"
 OPENPROJECT_SSO_LOGOUT_URL: "{{ lookup('tls', 'web-svc-logout', 'url.base') if (lookup('config', application_id, 'services.logout.enabled') | bool) else '' }}"
-# AuthSourceSSO resolves the header login only via the LDAP auth source, so the
-# header bridge is gated on LDAP being enabled too (else every login would fail).
 OPENPROJECT_HEADER_SSO_ENABLED: "{{ (OPENPROJECT_SSO_PROXY_GATED | bool) and (OPENPROJECT_LDAP_ENABLED | bool) }}"
 
-## LDAP
 OPENPROJECT_LDAP_ENABLED: "{{ lookup('config', application_id, 'services.ldap.enabled') }}"
 OPENPROJECT_LDAP_FILTER_ADMINISTRATORS_ENABLED: "{{ lookup('config', application_id, 'services.openproject.ldap.filters.administrators') }}"
 OPENPROJECT_LDAP_FILTER_USERS_ENABLED: "{{ lookup('config', application_id, 'services.openproject.ldap.filters.users') }}"
 OPENPROJECT_LDAP_FILTERS:
-  # The administrator filter just works in the Enterprise edition
   ADMINISTRATORS: "{{ '(memberOf=cn=openproject-admins,' ~ LDAP.DN.OU.ROLES ~ ')' if OPENPROJECT_LDAP_FILTER_ADMINISTRATORS_ENABLED | bool else '' }}"
   USERS: "{{ '(memberOf=cn=openproject-users,' ~ LDAP.DN.OU.ROLES ~ ')' if OPENPROJECT_LDAP_FILTER_USERS_ENABLED | bool else '' }}"
 

roles/web-app-opentalk/templates/controller.toml.j2

@@ -6,7 +6,7 @@ base_url = "{{ OPENTALK_URL }}"
 
 [http]
 port = {{ OPENTALK_CTRL_INTERNAL_PORT }}
-service_api_keys = [{ "id" = "controller", "secret" = "{{ lookup('config', application_id, 'credentials.service_api_secret') }}" }]
+service_api_keys = [{ "id" = "controller", "secret" = "{{ lookup('config', application_id, 'secrets.credentials.service_api_secret') }}" }]
 
 [database]
 url = "postgres://{{ lookup('database', application_id, 'username') }}:{{ lookup('database', application_id, 'password') }}@{{ lookup('database', application_id, 'host') }}:{{ lookup('database', application_id, 'port') }}/{{ lookup('database', application_id, 'name') }}"

roles/web-app-opentalk/vars/main.yml

@@ -29,7 +29,7 @@ OPENTALK_DOMAIN: "{{ lookup('domain', application_id) }}"
 OPENTALK_OIDC_ENABLED: "{{ lookup('config', application_id, 'services.sso.enabled') }}"
 
 OPENTALK_LIVEKIT_API_KEY: "controller"
-OPENTALK_LIVEKIT_API_SECRET: "{{ lookup('config', application_id, 'credentials.livekit_api_secret') }}"
+OPENTALK_LIVEKIT_API_SECRET: "{{ lookup('config', application_id, 'secrets.credentials.livekit_api_secret') }}"
 
 OPENTALK_OBJSTORE_CONTAINER_ADDRESS: "{{ lookup('container_address', application_id, lookup('objstore', application_id, 'engine')) }}"
 
@@ -38,14 +38,14 @@ OPENTALK_RABBIT_QUEUE: "opentalk_recorder"
 
 OPENTALK_RECORDER_CONTAINER: "{{ lookup('config', application_id, 'services.recorder.name') }}"
 OPENTALK_RECORDER_OIDC_CLIENT_ID: "opentalk-recorder"
-OPENTALK_RECORDER_OIDC_CLIENT_SECRET: "{{ lookup('config', application_id, 'credentials.recorder_oidc_client_secret') }}"
+OPENTALK_RECORDER_OIDC_CLIENT_SECRET: "{{ lookup('config', application_id, 'secrets.credentials.recorder_oidc_client_secret') }}"
 
 OPENTALK_KEYCLOAK_BASE_URL: "{{ lookup('tls', 'web-app-keycloak', 'url.base') | regex_replace('/+$','') }}"
 OPENTALK_KEYCLOAK_CONTAINER_ADDRESS: "{{ lookup('container_address', 'web-app-keycloak', 'keycloak') }}"
 OPENTALK_KEYCLOAK_REALM: "{{ OIDC.CLIENT.REALM }}"
 
 OPENTALK_CTRL_OIDC_CLIENT_ID: "opentalk-controller"
-OPENTALK_CTRL_OIDC_CLIENT_SECRET: "{{ lookup('config', application_id, 'credentials.controller_oidc_client_secret') }}"
+OPENTALK_CTRL_OIDC_CLIENT_SECRET: "{{ lookup('config', application_id, 'secrets.credentials.controller_oidc_client_secret') }}"
 
 OPENTALK_KEYCLOAK_CLIENT_ID: "{{ OPENTALK_CTRL_OIDC_CLIENT_ID }}"
 OPENTALK_KEYCLOAK_CLIENT_SECRET: "{{ OPENTALK_CTRL_OIDC_CLIENT_SECRET }}"

roles/web-app-peertube/templates/env.j2

@@ -21,7 +21,7 @@ PEERTUBE_LIVE_RTMP_ENABLED=true
 PEERTUBE_LIVE_RTMP_PORT={{ PEERTUBE_RTMP_PORT }}
 {% endif %}
 
-PEERTUBE_SECRET={{ lookup('config', application_id, 'credentials.secret')}}
+PEERTUBE_SECRET={{ lookup('config', application_id, 'secrets.credentials.secret')}}
 
 {% if lookup('objstore', application_id, 'enabled') | bool %}
 {% set objstore_bucket = lookup('objstore', application_id, 'bucket') %}

roles/web-app-penpot/vars/main.yml

@@ -18,7 +18,7 @@ PENPOT_EXPORTER_INTERNAL_PORT: "{{ lookup('config', application_id, 'services.ex
 
 PENPOT_PUBLIC_URI: "{{ lookup('tls', application_id, 'url.base') }}"
 
-PENPOT_SECRET_KEY: "{{ lookup('config', application_id, 'credentials.secret_key') }}"
+PENPOT_SECRET_KEY: "{{ lookup('config', application_id, 'secrets.credentials.secret_key') }}"
 
 PENPOT_ASSETS_FS_DIRECTORY: "/opt/data/assets"
 

roles/web-app-pgadmin/templates/env.j2

@@ -6,7 +6,7 @@ PGADMIN_DEFAULT_EMAIL={{ PGADMIN_ADMIN_EMAIL }}
 
 PGADMIN_CONFIG_ALLOW_SPECIAL_EMAIL_DOMAINS=['{{ PGADMIN_ADMIN_EMAIL_TLD }}']
 
-PGADMIN_DEFAULT_PASSWORD={{ lookup('config', application_id, 'credentials.administrator_password') | dotenv_quote }}
+PGADMIN_DEFAULT_PASSWORD={{ lookup('config', application_id, 'secrets.credentials.administrator_password') | dotenv_quote }}
 
 {% if PGADMIN_SERVER_MODE | bool %}
 PGADMIN_SERVER_JSON_FILE={{ pgadmin_docker_server_file }}

roles/web-app-pgadmin/vars/db_config.yml

@@ -10,6 +10,4 @@ pgadmin_servers:
     port: "{{ lookup('database', application_id, 'port') }}"
     username: "postgres"
     maintenance_db: "postgres"
-    password: "{{ lookup('applications', 'svc-db-postgres').credentials.POSTGRES_PASSWORD }}"
-
-# Here you can add more databases
+    password: "{{ lookup('applications', 'svc-db-postgres').secrets.credentials.POSTGRES_PASSWORD }}"

roles/web-app-phpmyadmin/vars/main.yml

@@ -3,11 +3,9 @@
 application_id: "web-app-phpmyadmin"
 database_host: "{{ lookup('config','svc-db-mariadb', 'services.mariadb.name') if lookup('database', application_id, 'shared') }}"
 
-# PHPMyAdmin
 PHPMYADMIN_CONTAINER: "{{ lookup('config', application_id, 'services.phpmyadmin.name') }}"
 PHPMAYADMIN_AUTOLOGIN_ENABLED: "{{ lookup('config', application_id, 'services.phpmyadmin.autologin') | bool }}"
 
-# Credentials
-PHPMAYADMIN_ROOT_PASSWORD: "{{ lookup('config','svc-db-mariadb', 'credentials.root_password') }}"
+PHPMAYADMIN_ROOT_PASSWORD: "{{ lookup('config','svc-db-mariadb', 'secrets.credentials.root_password') }}"
 PHPMAYADMIN_ROOT_USER: "root"
 PHPMAYADMIN_DB_HOST: "{{ lookup('config','svc-db-mariadb', 'services.mariadb.name') }}"

roles/web-app-pixelfed/templates/env.j2

@@ -1,6 +1,6 @@
 {% include 'roles/sys-svc-container/templates/env.j2' %}
 
-APP_KEY={{ lookup('config', application_id, 'credentials.app_key')}}
+APP_KEY={{ lookup('config', application_id, 'secrets.credentials.app_key')}}
 
 # nocheck: env-file-literal-quoted-value
 APP_NAME="{{ PIXELFED_TITEL }}"

roles/web-app-postmarks/templates/env.j2

@@ -3,8 +3,8 @@
 PORT={{ container_port }}
 NODE_ENV=production
 
-SESSION_SECRET={{ lookup('config', application_id, 'credentials.session_secret') | dotenv_quote }}
-ADMIN_KEY={{ lookup('config', application_id, 'credentials.admin_key') | dotenv_quote }}
+SESSION_SECRET={{ lookup('config', application_id, 'secrets.credentials.session_secret') | dotenv_quote }}
+ADMIN_KEY={{ lookup('config', application_id, 'secrets.credentials.admin_key') | dotenv_quote }}
 
 PROXY_HEADER_SSO={{ POSTMARKS_SSO_PROXY_GATED | string | lower }}
 PROXY_HEADER_SSO_ADMIN_GROUP={{ POSTMARKS_SSO_ADMIN_GROUP | dotenv_quote }}

roles/web-app-prometheus/vars/main.yml

@@ -14,9 +14,9 @@ ALERTMANAGER_CONFIG_DOCKER: "/etc/alertmanager/alertmanager.yml"
 ALERT_RULES_CONFIG_HOST: "{{ [ lookup('container', application_id, 'directories.config'), 'alert_rules.yml' ] | path_join }}"
 ALERT_RULES_CONFIG_DOCKER: "/etc/prometheus/alert_rules.yml"
 
-ALERTMANAGER_TELEGRAM_BOT_TOKEN: "{{ lookup('config', application_id, 'credentials.alerting_telegram_bot_token', '') }}"
+ALERTMANAGER_TELEGRAM_BOT_TOKEN: "{{ lookup('config', application_id, 'secrets.credentials.alerting_telegram_bot_token', '') }}"
 ALERTMANAGER_TELEGRAM_CHAT_ID: "{{ lookup('config', application_id, 'services.prometheus.alerting.telegram.chat_id') }}"
-ALERTMANAGER_MATTERMOST_WEBHOOK_URL: "{{ lookup('config', application_id, 'credentials.alerting_mattermost_webhook_url', '') }}"
+ALERTMANAGER_MATTERMOST_WEBHOOK_URL: "{{ lookup('config', application_id, 'secrets.credentials.alerting_mattermost_webhook_url', '') }}"
 
 BLACKBOX_CONTAINER: "{{ lookup('config', application_id, 'services.blackbox-exporter.name') }}"
 

roles/web-app-semaphore/vars/main.yml

@@ -7,9 +7,9 @@ SEMAPHORE_NAME: "{{ lookup('config', application_id, 'services.semaphore.name')
 SEMAPHORE_OIDC_ENABLED: "{{ lookup('config', application_id, 'services.sso.enabled') }}"
 SEMAPHORE_LDAP_ENABLED: "{{ lookup('config', application_id, 'services.ldap.enabled') }}"
 
-SEMAPHORE_ACCESS_KEY_ENCRYPTION: "{{ lookup('config', application_id, 'credentials.access_key_encryption') | regex_replace('^base64:', '') }}"
-SEMAPHORE_COOKIE_HASH: "{{ lookup('config', application_id, 'credentials.cookie_hash') | regex_replace('^base64:', '') }}"
-SEMAPHORE_COOKIE_ENCRYPTION: "{{ lookup('config', application_id, 'credentials.cookie_encryption') | regex_replace('^base64:', '') }}"
+SEMAPHORE_ACCESS_KEY_ENCRYPTION: "{{ lookup('config', application_id, 'secrets.credentials.access_key_encryption') | regex_replace('^base64:', '') }}"
+SEMAPHORE_COOKIE_HASH: "{{ lookup('config', application_id, 'secrets.credentials.cookie_hash') | regex_replace('^base64:', '') }}"
+SEMAPHORE_COOKIE_ENCRYPTION: "{{ lookup('config', application_id, 'secrets.credentials.cookie_encryption') | regex_replace('^base64:', '') }}"
 
 SEMAPHORE_ADMIN_USERNAME: "{{ lookup('users', 'web-app-semaphore-breakglass').username }}"
 SEMAPHORE_ADMIN_PASSWORD: "{{ lookup('users', 'web-app-semaphore-breakglass').password }}"

roles/web-app-shopware/vars/main.yml

@@ -41,4 +41,4 @@ SHOPWARE_OPENSEARCH_PORT: "{{ lookup('config', application_id, 'services.opensea
 SHOPWARE_OPENSEARCH_ENABLED: "{{ lookup('config', application_id, 'services.opensearch.enabled') }}"
 SHOPWARE_OPENSEARCH_CONTAINER: "{{ lookup('config', application_id, 'services.opensearch.name') }}"
 SHOPWARE_OPENSEARCH_MEM_RESERVATION: "{{ lookup('config', application_id, 'services.opensearch.mem_reservation') }}"
-SHOPWARE_OPENSEARCH_INITIAL_ADMIN_PASSWORD: "{{ lookup('config', application_id, 'credentials.opensearch_initial_admin_password') }}"
+SHOPWARE_OPENSEARCH_INITIAL_ADMIN_PASSWORD: "{{ lookup('config', application_id, 'secrets.credentials.opensearch_initial_admin_password') }}"

roles/web-app-snipe-it/templates/env.j2

@@ -3,7 +3,7 @@
 {# nocheck: comments-valid (upstream Snipe-IT .env.example; its section banners are intentional). #}
 APP_ENV={{ ENVIRONMENT | lower }}
 APP_DEBUG={{MODE_DEBUG | string | lower }}
-APP_KEY={{ lookup('config', application_id, 'credentials.app_key')}}
+APP_KEY={{ lookup('config', application_id, 'secrets.credentials.app_key')}}
 APP_URL={{ SNIPE_IT_URL | regex_replace('/$', '') }}
 APP_TIMEZONE='{{ HOST_TIMEZONE }}'
 APP_LOCALE={{ HOST_LL_CC }}

roles/web-app-snipe-it/vars/main.yml

@@ -4,7 +4,7 @@ entity_name: "{{ application_id | get_entity_name }}"
 
 swarm_stack_converge_retries: 600
 
-database_password: "{{ lookup('config', application_id, 'credentials.database_password') }}" # nocheck: lookup-config-path
+database_password: "{{ lookup('config', application_id, 'secrets.credentials.database_password') }}" # nocheck: lookup-config-path
 
 SNIPE_IT_URL: "{{ lookup('tls', application_id, 'url.base') }}"
 SNIPE_IT_CONTAINER: "{{ lookup('config', application_id, 'services.snipe-it.name') }}"
@@ -12,7 +12,7 @@ SNIPE_IT_IMAGE: "{{ lookup('config', application_id, 'services.snipe-it.image')
 SNIPE_IT_VERSION: "{{ lookup('config', application_id, 'services.snipe-it.version') }}"
 SNIPE_IT_SERVICE: "{{ entity_name }}"
 SNIPE_IT_CONTAINER_ADDRESS: "{{ lookup('container_address', application_id, SNIPE_IT_SERVICE) }}"
-SNIPE_IT_APP_KEY: "{{ lookup('config', application_id, 'credentials.app_key') }}"
+SNIPE_IT_APP_KEY: "{{ lookup('config', application_id, 'secrets.credentials.app_key') }}"
 
 SNIPE_IT_LDAP_ENABLED: "{{ lookup('config', application_id, 'services.ldap.enabled') }}"
 SNIPE_IT_TLS_ENABLED: "{{ lookup('tls', application_id, 'enabled') | bool }}"

roles/web-app-socialhome/vars/main.yml

@@ -8,7 +8,7 @@ SOCIALHOME_LISTEN_PORT: "{{ lookup('config', application_id, 'services.' ~ entit
 SOCIALHOME_INSTANCE_NAME: "{{ defaults_service_provider.platform.titel }}"
 
 SOCIALHOME_ADMIN_USERNAME: "{{ lookup('users', 'administrator').username }}"
-SOCIALHOME_ADMIN_PASSWORD: "{{ lookup('config', application_id, 'credentials.administrator_password') }}"
+SOCIALHOME_ADMIN_PASSWORD: "{{ lookup('config', application_id, 'secrets.credentials.administrator_password') }}"
 
 SOCIALHOME_CONFIG_FILE: "/etc/socialhome/socialhome.toml"
 SOCIALHOME_CONFIG_HOST_FILE: "{{ [lookup('container', application_id, 'directories.volumes'), 'socialhome.toml'] | path_join }}"
@@ -18,6 +18,6 @@ SOCIALHOME_MAX_STORAGE_BYTES: 4294967296
 SOCIALHOME_COTURN_ENABLED: "{{ lookup('config', application_id, 'services.coturn.enabled') | bool }}"
 SOCIALHOME_COTURN_HOST: "{{ lookup('domain', 'web-svc-coturn') if SOCIALHOME_COTURN_ENABLED | bool else '' }}"
 SOCIALHOME_COTURN_PORT: "{{ lookup('config', 'web-svc-coturn', 'services.coturn.ports.public.stun_turn') if SOCIALHOME_COTURN_ENABLED | bool else '' }}"
-SOCIALHOME_COTURN_SECRET: "{{ lookup('config', 'web-svc-coturn', 'credentials.auth_secret') if SOCIALHOME_COTURN_ENABLED | bool else '' }}"
+SOCIALHOME_COTURN_SECRET: "{{ lookup('config', 'web-svc-coturn', 'secrets.credentials.auth_secret') if SOCIALHOME_COTURN_ENABLED | bool else '' }}"
 SOCIALHOME_STUN_URL: "{{ 'stun:' ~ SOCIALHOME_COTURN_HOST ~ ':' ~ SOCIALHOME_COTURN_PORT if SOCIALHOME_COTURN_ENABLED | bool else '' }}"
 SOCIALHOME_TURN_URL: "{{ 'turn:' ~ SOCIALHOME_COTURN_HOST ~ ':' ~ SOCIALHOME_COTURN_PORT if SOCIALHOME_COTURN_ENABLED | bool else '' }}"

roles/web-app-suitecrm/templates/env.j2

@@ -18,7 +18,7 @@ SUITECRM_DB_USER={{ lookup('database', application_id, 'username') }}
 SUITECRM_DB_PASSWORD={{ lookup('database', application_id, 'password') | dotenv_quote }}
 
 SUITECRM_ADMIN_USERNAME={{ lookup('config', application_id, 'users.administrator.username') }}
-SUITECRM_ADMIN_PASSWORD={{ lookup('config', application_id, 'credentials.administrator_password') | dotenv_quote }}
+SUITECRM_ADMIN_PASSWORD={{ lookup('config', application_id, 'secrets.credentials.administrator_password') | dotenv_quote }}
 SUITECRM_ADMIN_EMAIL={{ lookup('users', 'administrator').email }}
 
 SUITECRM_URL={{ SUITECRM_URL }}

roles/web-app-suitecrm/templates/playwright.env.j2

@@ -1,4 +1,4 @@
-ADMIN_NATIVE_PASSWORD={{ lookup('config', application_id, 'credentials.administrator_password') | dotenv_quote }}
+ADMIN_NATIVE_PASSWORD={{ lookup('config', application_id, 'secrets.credentials.administrator_password') | dotenv_quote }}
 
 ADMIN_PASSWORD={{ lookup('users', 'administrator').password | dotenv_quote }}
 

roles/web-app-taiga/templates/env.j2

@@ -8,8 +8,8 @@ CSRF_COOKIE_SECURE={{ TAIGA_COOKIE_SECURE }}
 TAIGA_SUBPATH=
 WEBSOCKETS_SCHEME={{ lookup('tls', application_id, 'protocols.websocket') }}
 
-TAIGA_SECRET_KEY={{ lookup('config', application_id, 'credentials.secret_key') }}
-SECRET_KEY={{ lookup('config', application_id, 'credentials.secret_key') }}
+TAIGA_SECRET_KEY={{ lookup('config', application_id, 'secrets.credentials.secret_key') }}
+SECRET_KEY={{ lookup('config', application_id, 'secrets.credentials.secret_key') }}
 
 POSTGRES_USER={{ lookup('database', application_id, 'username') }}
 POSTGRES_PASSWORD={{ lookup('database', application_id, 'password') | dotenv_quote }}

roles/web-app-wordpress/templates/playwright.env.j2

@@ -47,7 +47,7 @@ SSO_SERVICE_ENABLED={{ lookup('service', 'sso').required | string | lower }}
 
 {{ lookup('addon_env_flags', application_id) }}
 
-SUPER_ADMIN_PASSWORD={{ (lookup('config', 'web-app-keycloak', 'credentials.administrator_password') | dotenv_quote) if (lookup('service', 'sso').required) else '""' }}
+SUPER_ADMIN_PASSWORD={{ (lookup('config', 'web-app-keycloak', 'secrets.credentials.administrator_password') | dotenv_quote) if (lookup('service', 'sso').required) else '""' }}
 
 SUPER_ADMIN_USERNAME={{ (lookup('config', 'web-app-keycloak', 'services.keycloak.accounts.system.username') | dotenv_quote) if (lookup('service', 'sso').required) else '""' }}
 

roles/web-app-wordpress/vars/main.yml

@@ -32,4 +32,4 @@ WORDPRESS_MU_PLUGINS_DIR: "{{ [WORDPRESS_DOCKER_HTML_PATH, 'wp-content/mu-plugin
 
 WORDPRESS_ADMIN_EMAIL: "{{ lookup('config', application_id, 'users.administrator.email') }}"
 WORDPRESS_ADMIN_USER: "{{ lookup('config', application_id, 'users.administrator.username') }}"
-WORDPRESS_ADMIN_PASSWORD: "{{ lookup('config', application_id, 'credentials.administrator_password') }}"
+WORDPRESS_ADMIN_PASSWORD: "{{ lookup('config', application_id, 'secrets.credentials.administrator_password') }}"