2026-06-16 03:40:31 +00:00
|
|
|
# MeshAI Secrets Template
|
|
|
|
|
# Copy to /data/secrets/.env and fill in your values
|
|
|
|
|
# This file is gitignored - never commit real secrets
|
|
|
|
|
|
|
|
|
|
# LLM API Keys (only one needed based on your backend choice)
|
|
|
|
|
OPENAI_API_KEY=
|
|
|
|
|
ANTHROPIC_API_KEY=
|
|
|
|
|
GOOGLE_API_KEY=
|
|
|
|
|
|
|
|
|
|
# Mesh Source Credentials
|
|
|
|
|
MESHMONITOR_API_TOKEN=
|
|
|
|
|
MQTT_PASSWORD=
|
|
|
|
|
|
|
|
|
|
# Environmental Feed Keys
|
|
|
|
|
TOMTOM_API_KEY=
|
|
|
|
|
FIRMS_MAP_KEY=
|
feat(secrets): GUI-managed .env secrets store — keys are config, but gitignored (#47)
API keys/secrets now live in /data/secrets/.env (gitignored, never in config
YAML), while remaining fully editable from the dashboard. Config YAML holds
only ${VAR} references.
Backend:
- meshai/secrets_store.py: get_status (SET/NOT-SET, never values), set_secret,
delete_secret over /data/secrets/.env (resolved like load_config); authoritative
SECRET_FIELD_TO_ENV map (traffic→TOMTOM_API_KEY, firms→FIRMS_MAP_KEY,
roads511→ROADS511_API_KEY, wzdx→WZDX_API_KEY, smtp→SMTP_PASSWORD,
mesh_sources→MESHMONITOR_API_TOKEN) + backend-dependent llm_env_var
- dashboard/api/secrets_routes.py: GET /api/secrets (status only), PUT/DELETE
/api/secrets/{env_var} (validated, restart_required); registered in server.py
- config_loader: save_section preserves ${VAR} secret refs on section save
(never rejects them); EXPECTED_SECRETS += ROADS511_API_KEY, WZDX_API_KEY
- config.example.yaml + docker-entrypoint default config use ${VAR} refs;
first-run bootstraps /data/secrets/.env; .gitignore covers it
Frontend:
- components/ManagedSecret.tsx: masked, Set/Not-set badge, reveal, Save->PUT,
"restart required"; carries no config value so secrets never enter a section
save payload
- wired into Environment (tomtom/roads511/wzdx/firms), Config LLM tab
(env var by backend), Notifications (smtp)
Restart required after a secret change (env read at config-load). 11 store
tests; suite at 10-failure baseline (1714 passed).
Co-authored-by: Matt Johnson <mj@k7zvx.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-07-05 17:57:45 -06:00
|
|
|
ROADS511_API_KEY=
|
|
|
|
|
WZDX_API_KEY=
|
2026-06-16 03:40:31 +00:00
|
|
|
|
|
|
|
|
# Notification Credentials
|
|
|
|
|
SMTP_PASSWORD=
|
