---
credentials:
  mcp_bearer:
    description: "Bearer an MCP client must present to this role's adapter instance. Distinct from the credential the adapter presents upstream: holding a token the
      application accepts says nothing about who called the adapter."
    algorithm: alphanumeric
    validation: "^[A-Za-z0-9]{32,}$"
    length: 48
  secret_key_base:
    description: Rails secret key base used to verify signed cookies and tokens
    algorithm: random_hex
    validation: "^[a-f0-9]{128}$"
  otp_key_base:
    description: Key base encrypting two-factor authentication secrets
    algorithm: random_hex
    validation: "^[a-f0-9]{128}$"
  db_key_base:
    description: "Key base encrypting CI/CD variable values, terraform state, Pages TLS private keys, and integration and webhook credentials. settings.rb raises
      MultipleDbKeyBaseError on a second key and upstream ships no re-encrypt task, so a rotation is one-way."
    algorithm: random_hex
    validation: "^[a-f0-9]{128}$"
    rotatable: false
  encrypted_settings_key_base:
    description: Key base encrypting settings files
    algorithm: random_hex
    validation: "^[a-f0-9]{128}$"
  active_record_encryption_primary_key:
    description: Primary key for Active Record encrypted columns
    algorithm: random_hex_16
    validation: "^[a-f0-9]{32}$"
  active_record_encryption_deterministic_key:
    description: Deterministic key for Active Record encrypted columns
    algorithm: random_hex_16
    validation: "^[a-f0-9]{32}$"
  active_record_encryption_key_derivation_salt:
    description: "PBKDF2 salt every Active Record encryption key derives from. It has no list form, so rotating it voids the primary-key rotation list as well."
    algorithm: random_hex_16
    validation: "^[a-f0-9]{32}$"
    rotatable: false
  gitlab_shell_secret:
    description: Shared token authenticating gitlab-shell and gitaly against the rails API
    algorithm: alphanumeric
    validation: "^[A-Za-z0-9]{64}$"
  gitaly_token:
    description: Auth token shared between rails and the gitaly gRPC listener
    algorithm: alphanumeric
    validation: "^[A-Za-z0-9]{64}$"
  workhorse_secret:
    description: 32-byte value shared between workhorse and rails, mounted base64-encoded
    algorithm: random_hex_16
    validation: "^[a-f0-9]{32}$"
  openid_connect_signing_key:
    description: RSA private key signing GitLab's own OpenID Connect provider tokens
    algorithm: rsa_pem_2048
    validation: "^-----BEGIN RSA PRIVATE KEY-----[\\s\\S]+-----END RSA PRIVATE KEY-----\\s*$"