Credential Storage Map
Last updated: 2026-06-22
Purpose: map where secrets live without recording the secrets themselves. This page intentionally contains locations only. If you paste a live password here, Satan gets a helpdesk ticket and everyone loses.
Rules
- Do not include actual passwords, token secrets, API keys, seed phrases, recovery codes, private keys, OAuth client secrets, or cookie/session values.
- Document storage location, owner, rotation notes, and access path only.
- When a secret is moved, update this map and rotate if exposure is suspected.
Hermes / Gilfoyle Credential Locations
| Category | Storage Location | Used By | Notes |
|---|---|---|---|
| Infrastructure API credentials | /home/michaeld/.hermes/.env on Hermes VM 108 |
Hermes tools/scripts/cron jobs | Contains Proxmox, PBS, Wazuh, CrowdSec, UniFi, AdGuard, Uptime Kuma, URBackup, Tailscale/NPM-style operational values as configured. Values intentionally omitted. |
| Hermes profiles/config | /home/michaeld/.hermes/ |
Hermes runtime | Config, skills, scripts, cron metadata, memories. Do not store exported plaintext secrets in wiki pages. |
| Hermes cron job definitions | Hermes scheduler store | Hermes cron | Job metadata references scripts; secrets should be loaded from environment/config, not hardcoded. |
Application / Platform Secret Stores
| System | Storage Location | Secret Type | Notes |
|---|---|---|---|
| n8n | n8n internal credential store/volume on 10.10.10.237 | Workflow credentials | Exact mounted path and encryption key location NEEDS VERIFICATION. Workflows exported without secret values. |
| Portainer on 10.10.10.237 | Portainer data volume/container storage | Portainer users, endpoint credentials, TLS material | Exact host path NEEDS VERIFICATION. Endpoint mappings documented elsewhere; do not export credentials to wiki. |
| Portainer on 10.10.10.76 | Portainer data volume/container storage | Portainer users/endpoints | Exact host path NEEDS VERIFICATION. |
| Nginx Proxy Manager | Docker volume/appdata on 10.10.10.237 | Proxy host config, cert metadata, ACME material | Exact host path NEEDS VERIFICATION. Certificates/keys should remain on host/volume. |
| Uptime Kuma | Docker volume/appdata on 10.10.10.237 | Monitor config, notification tokens, API key | Exact path NEEDS VERIFICATION. Hermes uses API key from .env for metrics. |
| Wazuh | Wazuh VM 10.10.10.233 | Wazuh users/API auth/indexer certs | Credentials stored in Wazuh service config/auth stores; Hermes API credential location is .hermes/.env. Exact paths NEEDS VERIFICATION. |
| CrowdSec | Containers/host config on 10.10.10.237 and 10.10.10.76 | Local API keys, bouncer keys, machine credentials | Hermes has machine/API credentials in .hermes/.env; bouncer secrets live in CrowdSec/bouncer config volumes. Exact paths NEEDS VERIFICATION. |
| AdGuard Home | AdGuard host/container config | Admin auth and DNS settings | Hermes credential location is .hermes/.env; exact AdGuard config path NEEDS VERIFICATION. |
| Home Assistant | Home Assistant VM/config store | HA users, long-lived tokens, integrations | Exact backup/secret storage path NEEDS VERIFICATION. |
| Cloudflare | Cloudflare dashboard/API token store plus local env files where used | DNS/WAF/Tunnel/API tokens | Token locations outside Hermes NEEDS VERIFICATION. Do not publish tokens. |
| Tailscale | Tailscale admin console plus Hermes .env for monitoring key |
API key / device auth | Hermes monitors key expiry; key value belongs in .hermes/.env or provider vault. |
| QNAP NAS units | QNAP OS credential stores; password manager/vault NEEDS VERIFICATION | NAS users, SMB/NFS/admin, Container Station TLS | Exact vault path and service accounts NEEDS VERIFICATION. |
| UniFi | UDM-SE local account store; Hermes .env for automation password |
UniFi admin/API access | Local Super Admin account exists; password value stored outside the wiki. |
| PBS | PBS credential store; Hermes .env for automation password |
PBS root/API access | Exact token strategy NEEDS VERIFICATION. |
| URBackup | URBackup app config; Hermes .env for automation password |
URBackup web/API credentials | Exact host path NEEDS VERIFICATION. |
Password Manager / Human Vault
| Secret Category | Storage Location | Owner | Rotation Notes |
|---|---|---|---|
| Human/admin passwords | NEEDS VERIFICATION | Michael | Confirm whether these live in a password manager, which vault name, and emergency access process. |
| Cloud provider / domain registrar / Cloudflare owner credentials | NEEDS VERIFICATION | Michael | Do not document values here; document vault location only after confirmation. |
| Recovery codes / break-glass material | NEEDS VERIFICATION | Michael | Should be offline or in the agreed password manager. Exact location must be confirmed by Michael. |
| SSH private keys | User/key-specific locations on admin workstations and servers | Michael / service owners | Do not paste keys. Inventory locations and rotation policy NEEDS VERIFICATION. |
Environment Files / Host Paths
| Host | Path | Used By | Notes |
|---|---|---|---|
| Hermes VM 108 | /home/michaeld/.hermes/.env |
Hermes tools, scripts, cron jobs | Primary automation secret file verified by this session. |
| Docker VM 101 / 10.10.10.237 | /home/docker/... stack directories and app volumes |
Docker stacks | Many stacks likely carry .env files or mounted config. Exact per-stack paths NEEDS VERIFICATION. |
| Docker host 10.10.10.76 | Docker compose/app directories | URBackup/backup containers/Portainer | Exact paths NEEDS VERIFICATION. |
| QNAP NAS units | Container Station/app shares | QNAP-hosted apps and TLS endpoints | Exact paths NEEDS VERIFICATION. |
NEEDS VERIFICATION
- Password manager/vault product and exact vault names.
- Exact n8n credential/encryption-key storage path.
- Exact Portainer/NPM/Uptime Kuma appdata paths.
- Exact per-host
.envfiles used by Docker stacks. - Break-glass recovery material location and who can access it.