diff options
| author | Anders Betts <anders.betts@gmail.com> | 2026-09-20 15:58:10 +0200 |
|---|---|---|
| committer | Anders Betts <anders.betts@gmail.com> | 2026-09-20 15:58:10 +0200 |
| commit | c0d08b0880dcce7337d9bdf046c93b318a84c2dc (patch) | |
| tree | f411be2a92e7b60fc311a31fd8037d28fafd4c0b /docs | |
| parent | 90068419d51b0289c65d4db9e14849fbecd34a95 (diff) | |
| download | bokf-c0d08b0880dcce7337d9bdf046c93b318a84c2dc.tar.gz bokf-c0d08b0880dcce7337d9bdf046c93b318a84c2dc.zip | |
deploy: pass BOKFD_SECRET_KEY through compose; document waves 1-2
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/DEPLOY.md | 6 | ||||
| -rw-r--r-- | docs/STATE.md | 5 |
2 files changed, 11 insertions, 0 deletions
diff --git a/docs/DEPLOY.md b/docs/DEPLOY.md index ed105f8..7385a8f 100644 --- a/docs/DEPLOY.md +++ b/docs/DEPLOY.md @@ -184,8 +184,14 @@ LEGO_DOMAIN=bokf.makandra.eu LEGO_EMAIL=anders@makandra.eu INWX_USERNAME=... INWX_PASSWORD=... +BOKFD_SECRET_KEY=... # openssl rand -hex 32 ``` +`BOKFD_SECRET_KEY` encrypts secrets that live in the database (the SMTP +password) with AES-256-GCM; without it, setting or sending with a mail +password fails. Keep it out of the repository and out of backups of the +database — losing it only means re-entering the SMTP password. + Forward port 8788 on the router to the host. The `certs` sidecar obtains and renews the certificate into `var/db/certs/certificates/`; `bokfd` reloads it in place. On the very first `up`, `bokfd` may restart a few times until the diff --git a/docs/STATE.md b/docs/STATE.md index 981aace..8b33b52 100644 --- a/docs/STATE.md +++ b/docs/STATE.md @@ -158,6 +158,11 @@ check. Settings `invoice_receivable_account`, `invoice_revenue_account`, `invoice_bankgiro`. **Swish QR: decided 2026-09-20 — not supported** (invoice 1's QR is dropped; the generator has no image support). + **Wave 2 done 2026-09-20**: settings secrets are AES-256-GCM encrypted + with `BOKFD_SECRET_KEY` (`smtp_password`; `settings.get` never returns + it), SMTP over TLS/STARTTLS/plain (`src/smtp.c`) and `invoice.send` + (subject `Faktura <nr>`, PDF attached, `last_sent_*`, audited, + `SMTP_NOT_CONFIGURED`/`SMTP_FAILED`). Wave 3 (TUI Fakturering) pending. ## Pending decisions |