Metadata-Version: 2.4
Name: ophix-creds
Version: 2026.10.8.1
Summary: Credentials domain plugin for Ophix Project Servers
Author: Ophix Project
License-Expression: MIT
Project-URL: Homepage, https://ophix.io
Project-URL: Documentation, https://github.com/ophixproject/ophix-creds#readme
Project-URL: Source, https://github.com/ophixproject/ophix-creds
Keywords: django,ophix,credentials,secrets,fleet management
Classifier: Development Status :: 4 - Beta
Classifier: Environment :: Web Environment
Classifier: Framework :: Django
Classifier: Intended Audience :: System Administrators
Classifier: Operating System :: OS Independent
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Programming Language :: Python :: 3.14
Classifier: Topic :: Internet :: WWW/HTTP :: Dynamic Content
Classifier: Topic :: System :: Systems Administration
Requires-Python: >=3.10
Description-Content-Type: text/markdown
License-File: LICENSE
Requires-Dist: ophix-server-base>=2026.06.08.01
Requires-Dist: ophix-codemirror>=2026.06.05.01
Requires-Dist: cryptography>=41.0
Dynamic: license-file

# ophix-creds

**One place to store fleet secrets, instead of one more copy in every server's `.env` file.**

If your deploy scripts and server configs have ended up with database passwords, API keys, and other secrets copied onto every host that happens to need them, `ophix-creds` gives your fleet one central place to store them instead. Clients fetch a named secret on demand over HTTPS — authenticated with a per-client token and IP check — and hold it in memory only; nothing is written to disk or cached locally on the client side.

Access is granted per client, per credential: a client can be given read, update, delete, or no access at all to any given secret, and any grant can be revoked instantly without touching the credential itself. Secrets are encrypted at rest on the server.

---

## Installation

See [installation.md](installation.md) for the full step-by-step guide — service user, TLS setup, the guided installer, and getting the service running under nginx and systemd.

---

## Routine upgrades

The guided installer generates `ophixcredserver-update.sh` (Step 4 in
[installation.md](installation.md)) — a single script that checks for and installs package
updates, then runs `migrate`, `collectstatic`, `generate_config --append` (picks up any new
`.env` settings automatically), refreshes documentation, and refreshes the Plugin Versions
table. Run it as the service user, not root:

```bash
./ophixcredserver-update.sh
```

It finishes by printing a reminder to restart the service — it doesn't restart it for you.
If you ever move the venv or change `INSTALL_DIR`, re-run `ophix-manage create_update_script`
first to regenerate the script with the new paths.

---

## What this plugin provides

- `Credential` model — named JSON secret with `enabled` flag
- `ClientCredential` join model — per-client permissions
  (`enabled`, `can_update`, `can_delete`, `can_share`)
- `GET/POST/PUT/DELETE /api/credentials/<name>/` API endpoints
- Django admin with inline `ClientCredential` management and linked-artifact columns
- Access audit logging via `ophix.core.audit`
- Built-in documentation (loaded by `update_docs` if `ophix-docs` is installed)

---

## Configuration (`.env`)

| Variable | Default | Purpose |
| --- | --- | --- |
| `CRED_ENCRYPTION_KEY` | *(generated)* | Fernet key used to encrypt secrets at rest — generated by `configure_install` |
| `ENABLE_ARTIFACT_DELETE` | `False` | Allow clients to delete credentials they own |

---

## Client

Fleet clients use [ophix-cred-client](https://github.com/ophixproject/ophix-cred-client)
to authenticate and fetch credentials.

---

## Documentation

If `ophix-docs` is installed, documentation is loaded automatically during `run_install`.
To load or refresh docs manually after an upgrade:

```bash
ophix-manage update_docs --include-app-docs ophix.core,ophix_creds,ophix_docs
```

See [ophix-docs](https://github.com/ophixproject/ophix-docs) for the full list of
documentation management commands.
