Generic rules (never echo secrets, env hygiene): see
.agentstack/docs/security.md.
Bootstrap scripts warn if the deployment env file is world-readable. Recommend chmod 600:
chmod 600 ~/.printstack/default.env| Track in git | Never track |
|---|---|
examples/deployment.env.example | ~/.printstack/*.env (real deployment files) |
| Scripts, cloud-init templates | *.img, *.img.xz |
~/.printstack/ (artifacts, logs, deployment *.env files) lives outside the repo entirely -- nothing there is ever tracked or gitignored, it just never enters the working tree.
All in the single deployment env file (~/.printstack/default.env by default):
| Secret | Used for |
|---|---|
WIFI_PASSWORD | Pi WiFi join |
SSH_PUBKEYS | SSH access on all nodes |
NAMECHEAP_API_KEY | DNS-01 TLS challenge |
NAMECHEAP_API_USER | Namecheap API auth |
Namecheap API requires whitelisting NAMECHEAP_CLIENT_IP (management machine's public IP). The API key grants DNS record modification for domains in the account -- protect it like a password.
- SSH: restricted to
SSH_CIDRSwhen set; otherwise open to any - Print services: always restricted to
PRINT_CIDRS - TLS mode: port 443 open to any (required for HTTPS printing from outside LAN if desired)
When tightening SSH, ensure your management machine's IP is in SSH_CIDRS.