---
credentials:
  litellm_api_key:
    description: Per-consumer virtual key for the shared svc-ai-litellm gateway
    algorithm: sk_prefixed
    validation:
      min_length: 50
  talk_recording_secret:
    description: Shared secret between Nextcloud Talk and the recording backend
    algorithm: random_hex_32
    validation: ^[a-f0-9]{64}$
  whiteboard_jwt_secret:
    description: Secret used for JWT signing
    algorithm: base64_prefixed_32
    validation: ^base64:[A-Za-z0-9+/]{43}=$
  administrator_password:
    description: Initial password for the Nextcloud administrator (change immediately and enable 2FA)
    algorithm: sha256
    validation: ^[a-f0-9]{64}$
  talk_turn_secret:
    description: TURN REST secret for the optional onboard Talk TURN server
    algorithm: base64_prefixed_32
    validation: ^base64:[A-Za-z0-9+/]{43}=$
  talk_signaling_secret:
    description: Secret for Talk signaling
    algorithm: base64_prefixed_32
    validation: ^base64:[A-Za-z0-9+/]{43}=$
  talk_internal_secret:
    description: Internal secret for AIO Talk
    algorithm: base64_prefixed_32
    validation: ^base64:[A-Za-z0-9+/]{43}=$
  context_agent_app_secret:
    description: Shared secret between the Nextcloud AppAPI proxy and the Context Agent ExApp serving the MCP endpoint
    algorithm: alphanumeric
    validation:
      min_length: 64
  mcp_bearer:
    description: Bearer an MCP client presents to the Context Agent adapter sidecar. Distinct from the app password the sidecar presents upstream, because
      reaching the hub says nothing about who called the adapter.
    algorithm: alphanumeric
    validation: "^[A-Za-z0-9]{32,}$"
    length: 48