# Install Secrets Recovery

This project keeps runtime installation secrets in `apps/api/data/secrets/install.env`.

## Important

- Do not rotate `POSTGRES_PASSWORD`, `JWT_ACCESS_SECRET`, or `JWT_REFRESH_PEPPER` automatically after first bootstrap.
- A mismatch between `install.env` and initialized Postgres volume can break database access.

## Safe recovery steps

1. Stop services:
   - `docker compose down`
2. Restore `apps/api/data/secrets/install.env` from backup.
3. Start services:
   - `docker compose up -d --build`

If backup is unavailable, you have two options:

- Preferred: recover credentials directly from running database/admin secret reveal in another environment.
- Last resort: reset local volumes and lose local dev data:
  - `docker compose down -v`
  - `python apps/api/scripts/bootstrap_install.py`
  - `docker compose up -d --build`

## Dev access ports

To expose DB/Redis/MinIO to host tools:

- `docker compose -f docker-compose.yml -f docker-compose.dev-ports.yml up -d`