Secrets & Environment Variables — Source of Truth

Scope: every secret, credential, and configuration value needed across Fly, Render, GitHub Actions, Cloudflare, Stripe and the four SaaS providers. Rule #1: secrets never live in the repo. appsettings.*.json may contain defaults but never production values. Rule #2: rotate anything listed here if it ever lands in a chat log, screenshot, ticket, or PR diff.

Where secrets live

Do not use fly.*.toml [env] blocks for secrets — those are committed to git. Only put non-sensitive public config there (URLs, feature flags, ASP.NET env names).

Master table — every value, where it comes from, who consumes it

Abbreviations in the “Consumer” column: A = FlowerShop.API · K = Keycloak · C = CustomerApp · Ad = AdminPortal · Ve = VendorPortal · GHA = GitHub Actions · DNS = Cloudflare.

Data plane

Keycloak — DB & admin

Auth — API & CustomerApp

Stripe

CORS & forwarded headers

Portals (Render env vars)

VendorPortal additionally uses Keycloak for vendor login (confidential client flowershop-vendor-portal). Set Authentication__Authority, Authentication__ClientId, Authentication__ClientSecret the same way as CustomerApp, but with the vendor-portal client.

Photo storage (post-EP-15)

GitHub Actions secrets

These drive the deploy workflows under .github/workflows/.

The following are optional GHA secrets used only during bootstrap (to fly secrets set in an ad-hoc workflow, instead of from your laptop). After bootstrap they can be deleted from GHA:

• AIVEN_PG_CONNECTION
• UPSTASH_REDIS_URL
• CLOUDAMQP_URL
• HIVEMQ_HOST, HIVEMQ_USER, HIVEMQ_PASS
• KEYCLOAK_ADMIN_PASSWORD
• KEYCLOAK_CLIENT_SECRET_API, KEYCLOAK_CLIENT_SECRET_CUSTOMER
• STRIPE_SECRET_KEY, STRIPE_WEBHOOK_SECRET

Converting an Aiven URI to Npgsql format

Aiven gives you postgres://user:pass@host:12345/defaultdb?sslmode=require. .NET Npgsql wants Host=host;Port=12345;Database=defaultdb;Username=user;Password=pass;SslMode=Require.

aiven_uri_to_npgsql() {
  python3 - <<PY
from urllib.parse import urlparse, unquote
u = urlparse("$1")
print(f"Host={u.hostname};Port={u.port};Database={u.path.lstrip('/')};Username={unquote(u.username)};Password={unquote(u.password)};SslMode=Require")
PY
}

aiven_uri_to_npgsql "postgres://avnadmin:xxx@xxx.aivencloud.com:12345/flowershop_iot?sslmode=require"

Rotation procedure

Any compromised value, rotate in this order:

1. Rotate at the source (Keycloak client secret regen / Stripe key roll / Upstash password reset).
2. Update the value in every consumer’s secret store (see Consumer column above).
3. For Fly apps: fly secrets set ... auto-rolls the machine.
4. For Render services: a redeploy picks up new env vars (curl -X POST ...deploys from the workflow is enough).
5. For GitHub Actions: overwrite the secret, then rerun the last deploy of every consumer workflow so the value is live.
6. Audit — fly secrets list --app <name> shows fingerprints; confirm they changed.

Do not delete the old value until the new one has been verified in prod — a rollback may need it.

What never goes into a secret store

• Git history (even once, even in a revert — the commit is still reachable via SHA).
• appsettings.*.json in the repo.
• Docker image layers (baked-in env vars leak to anyone with pull access).
• Error logs / Sentry breadcrumbs — scrub before sending.
• Support-ticket attachments to SaaS vendors.