site/docs/secrets-recovery.md

Install Secrets Recovery

This project keeps runtime installation secrets in apps/api/data/secrets/install.env.

Important

• Do not rotate POSTGRES_PASSWORD, JWT_ACCESS_SECRET, or JWT_REFRESH_PEPPER automatically after first bootstrap.
• A mismatch between install.env and initialized Postgres volume can break database access.

Safe recovery steps

1. Stop services:
   • docker compose down
2. Restore apps/api/data/secrets/install.env from backup.
3. Start services:
   • docker compose up -d --build

If backup is unavailable, you have two options:

• Preferred: recover credentials directly from running database/admin secret reveal in another environment.
• Last resort: reset local volumes and lose local dev data:
  • docker compose down -v
  • python apps/api/scripts/bootstrap_install.py
  • docker compose up -d --build

Dev access ports

To expose DB/Redis/MinIO to host tools:

• docker compose -f docker-compose.yml -f docker-compose.dev-ports.yml up -d