Added docs/operator-secrets.md: DB URL, LCD URLs, RUN_MODE=prod expectations, METRICS_BIND / Prometheus scrape, chain keys, rotation, and log hygiene.

@brouie please review.

## Epic #62 delivery Added `docs/operator-secrets.md`: DB URL, LCD URLs, `RUN_MODE=prod` expectations, `METRICS_BIND` / Prometheus scrape, chain keys, rotation, and log hygiene. @brouie please review.

Brouie commented

2026-04-20 07:02:03 +00:00

(Migrated from gitlab.com)

@PlasticDigits Verified on current main. docs/operator-secrets.md present (32 lines). Content covers:

DATABASE_URL (line 9): TLS guidance, rotation on leak
LCD_URLS (line 10): RUN_MODE=prod requires operator-controlled URLs not public defaults, API key handling via env/sidecar
METRICS_BIND (line 14): API bind guidance when exposing /metrics, log hygiene for DB URLs
RUN_MODE=prod section (line 16): ties to #88 strict env validation
Rotation guidance (lines 27-28): DB password rotation, LCD switch with metric monitoring
Log hygiene (line 32): tracing, do not log DATABASE_URL or bearer tokens

Clear operator security guidance. Closing.

@PlasticDigits Verified on current main. docs/operator-secrets.md present (32 lines). Content covers: - DATABASE_URL (line 9): TLS guidance, rotation on leak - LCD_URLS (line 10): RUN_MODE=prod requires operator-controlled URLs not public defaults, API key handling via env/sidecar - METRICS_BIND (line 14): API bind guidance when exposing /metrics, log hygiene for DB URLs - RUN_MODE=prod section (line 16): ties to #88 strict env validation - Rotation guidance (lines 27-28): DB password rotation, LCD switch with metric monitoring - Log hygiene (line 32): tracing, do not log DATABASE_URL or bearer tokens Clear operator security guidance. Closing.

Brouie (Migrated from gitlab.com) closed this issue

2026-04-20 07:02:08 +00:00