# Bootstrap Secret Inputs

`bootstrap` uses the Flux age identity in ignored `.age/` storage to encrypt
the configured Democratic CSI Secret directly into the generated cluster
repository. Its TrueNAS API key is never printed or committed in plaintext.

`operational-secrets.sops.yaml` is decrypted only in MaidnCLI memory after
OpenBao is initialized. It is not copied to the cluster repository. Its schema
is:

```yaml
secrets:
  cicd/forgejo:
    username: encrypted-value
    token: encrypted-value
  cicd/forgejo-registry:
    dockerconfigjson: encrypted-value
  cicd/forgejo-webhook:
    authorization: encrypted-value
  platform/pihole:
    server: encrypted-value
    password: encrypted-value
  platform/cloudflare:
    api-token: encrypted-value
  platform/cloudflare-tunnel:
    token: encrypted-value
```

Keys are written to OpenBao KV v2 under `secret/<path>`. Additional paths are
allowed when they use lowercase path characters and scalar property names.

Set all `democraticCsi` settings in the bootstrap configuration or provide
them through the interactive wizard. The CLI writes those values only to
`base/democratic-csi/secret.sops.yaml` in the generated cluster repository.
For an existing configuration, run `bootstrap --config <path>
--prompt-democratic-csi` to enter the settings with the API key masked.

For a new operational-secret input, run `bootstrap --config <path>
--prompt-operational-secrets`. It derives Forgejo Git and registry credentials
from the configured Forgejo account, prompts for the Pi-hole server and masked
password, masked Cloudflare DNS-01 and Tunnel tokens, and generates the webhook
authorization value. The DNS-01 token issues the Gateway certificate; it is not
used by ExternalDNS.

`cicd/forgejo-webhook.authorization` is required for delivery bootstrap. The
CLI supplies it as the Forgejo webhook Authorization header and Tekton compares
that header against the ExternalSecret-derived `forgejo-webhook` Secret.

Run `bootstrap --config <path> --initialize-openbao-recovery` to create and
save a separate recovery age identity for `openbao-recovery.age`. The Flux SOPS
age identity is installed in `flux-system`; it must not encrypt OpenBao
recovery material.