Keryx / sourcectl secret store

Approved: 1 September 2026

This packet names the approved secret store and the durable evidence archive for Keryx for SafeCall (#114 OA-114-archive). Policy for what to back up lives in Android signing and iOS signing. This page is where files live and how to reach them.

It does not close #114 (org roles, EU trader, Play/Apple account verification stay separate). OA-114-archive is done (1 September 2026): share reachable from GLaDOS and MiniVan-3, evidence notes in evidence/keryx/, both Macs’ .p12 files in secrets/keryx/iOS/, unlock steps in nas-unlock.md.

Decision

Choice	Value
Host	Existing Proxmox CT 500 nas (Debian, privileged), 192.168.178.213
At rest	gocryptfs on /srv/sourcectl.cipher → mount /srv/sourcectl
Access	File Browser (LAN HTTP) and SFTP to the same mount
Users	File Browser users + Unix user sourcectl for SFTP
Network	LAN only (192.168.178.0/24). No port forward, no public DNS
Daily logins	Apple Passwords (unchanged)
Not this (now)	Vaultwarden, Docker, a new LXC/VM, vault.sourcectl.com, Samba for secrets

Do not put .jks, .p12, .p8, or key.properties on Samba [public] or [builders]. Those shares stay for non-secret files; macOS discovery/mount failures are why secrets do not go there.

File Browser v2.63.23 is the last release; the project was archived 2026-09-01 (unmaintained). Use it only on the LAN, leave the command runner disabled, and prefer SFTP if you stop trusting the web UI later.

Honest limits: this is not travel-from-hotel access. After a NAS reboot you must unlock gocryptfs or File Browser/SFTP see an empty or missing root. A stolen disk without the gocryptfs passphrase is ciphertext.

Do not put passwords, keystores, .p12, .p8, or tokens in git, Slack, email, or ~/sourcectl/keryx-release-evidence/ (checksums only).

Layout on the unlocked mount

Path	Contents
/srv/sourcectl/secrets/keryx/android/	upload-keystore.jks, key.properties
/srv/sourcectl/secrets/keryx/iOS/	Apple Distribution .p12 (GLaDOS + MiniVan); APNs .p8 when it exists
/srv/sourcectl/secrets/keryx/ntfy/	Host / username notes for the dual-run ntfy users (no tk_… or passwords)
/srv/sourcectl/secrets/keryx/firebase/	Firebase Admin SDK JSON used as ntfy firebase-key-file (never git)
/srv/sourcectl/evidence/keryx/	AAB/IPA checksum notes (no secrets)

~/sourcectl/keryx-release-evidence/ on the Macs may stay as a scratch copy.

1. FUSE on CT 500

On the Proxmox host (once):

pct set 500 -features fuse=1
pct reboot 500

Inside nas:

apt-get update
apt-get install -y gocryptfs fuse
grep -q '^user_allow_other' /etc/fuse.conf \
  || echo user_allow_other >> /etc/fuse.conf

2. Encrypted directory

Still inside nas. Passphrase is not stored on disk and not in git.

mkdir -p /srv/sourcectl.cipher /srv/sourcectl
chown root:root /srv/sourcectl.cipher
gocryptfs -init /srv/sourcectl.cipher
gocryptfs -allow_other /srv/sourcectl.cipher /srv/sourcectl
groupadd --force sourcectl
mkdir -p /srv/sourcectl/secrets /srv/sourcectl/evidence
chown -R root:sourcectl /srv/sourcectl
chmod 2770 /srv/sourcectl /srv/sourcectl/secrets /srv/sourcectl/evidence

After every NAS reboot, follow nas-unlock.md before starting File Browser. Do not put the passphrase in a world-readable script or in git.

3. File Browser (LAN web UI)

Last planned binary: GitHub filebrowser v2.63.23 (linux-amd64-filebrowser.tar.gz + checksums file). Verify SHA-256 before install.

useradd --system --home /var/lib/filebrowser --shell /usr/sbin/nologin filebrowser
usermod -aG sourcectl filebrowser
mkdir -p /var/lib/filebrowser
# copy filebrowser binary to /usr/local/bin/filebrowser
chmod 755 /usr/local/bin/filebrowser
chown -R filebrowser:filebrowser /var/lib/filebrowser

Initialize config (run as root; then chown the db). Bind only the NAS LAN address. Leave exec/hooks disabled (default).

filebrowser config init -d /var/lib/filebrowser/filebrowser.db
filebrowser config set -d /var/lib/filebrowser/filebrowser.db \
  --address 192.168.178.213 \
  --port 8080 \
  --root /srv/sourcectl
filebrowser users add sourcectl PLACEHOLDER --perm.admin \
  -d /var/lib/filebrowser/filebrowser.db
# replace PLACEHOLDER in the terminal only; do not record the password in git
# then change it in the web UI
chown filebrowser:filebrowser /var/lib/filebrowser/filebrowser.db

/etc/systemd/system/filebrowser.service:

[Unit]
Description=File Browser (LAN secret store)
After=network.target
# Start only after you have unlocked gocryptfs (see §2)

[Service]
User=filebrowser
Group=filebrowser
ExecStart=/usr/local/bin/filebrowser -d /var/lib/filebrowser/filebrowser.db
Restart=on-failure

[Install]
WantedBy=multi-user.target

systemctl daemon-reload
systemctl enable filebrowser.service
systemctl start filebrowser.service

From GLaDOS on LAN: http://192.168.178.213:8080 — not from the public internet. Optional nftables: accept tcp/8080 only from 192.168.178.0/24.

Add a second File Browser user without admin if MiniVan should not manage accounts.

4. SFTP fallback (Finder)

Same unlocked tree. Skip Samba.

id sourcectl >/dev/null 2>&1 || useradd --home /srv/sourcectl --shell /usr/sbin/nologin sourcectl
usermod -aG sourcectl sourcectl
passwd sourcectl
# password not in git; keep 2770 group sourcectl on secrets/ and evidence/

sshd snippet (/etc/ssh/sshd_config.d/sourcectl-sftp.conf):

Match User sourcectl
    ForceCommand internal-sftp
    PasswordAuthentication yes
    AllowTcpForwarding no
    X11Forwarding no

systemctl reload ssh. From a Mac: Finder → Go → Connect to Server → sftp://192.168.178.213 as sourcectl. This user has no shell.

If sshd already listens on 0.0.0.0, restrict with the CT firewall: SSH from LAN only (you likely already do that for nas admin).

5. What to copy now

Into secrets/:

• keryx/android/upload-keystore.jks + store password + key password + alias upload (password in a small sidecar text file only on the share, never git)
• keryx/android/key.properties
• GLaDOS Apple Distribution .p12 (recreate Distribution in Xcode if Keychain only shows Developer ID — that is the wrong identity) named keryx-apple-distribution-glados-8P59575P2K.p12 plus export password
• MiniVan .p12 as keryx-apple-distribution-minivan-8P59575P2K.p12
• SSH keys that must survive GLaDOS (e.g. gitlab_sourcectl), not a zip of ~/.ssh
• APNs .p8 when it exists (OA-110-apns-p8)

Into evidence/: copy ~/sourcectl/keryx-release-evidence/*.txt.

Confirm git check-ignore still lists key.properties and the .jks. Never git add them.

6. Close bars

Log row	Status (1 September 2026)
OA-114-archive	Done. Unlock: nas-unlock.md. File Browser from GLaDOS and MiniVan-3. evidence/keryx/ populated.
OA-110-cert-backup	Done. Both Macs’ Apple Distribution .p12 in secrets/keryx/iOS/.
#114	Still open: OA-114-apple-org, OA-114-play-org, OA-114-eu-trader.

Later (not this phase)

A self-hosted password manager (Vaultwarden) behind vault.sourcectl.com can wait until there is a larger server and time. Do not start that LXC while Keryx signing files only need this NAS directory.

Related documents

• Operator actions
• NAS unlock after reboot
• Android signing
• iOS signing
• Publishing Keryx
• ntfy auth dual-run and Play Internal
• Keryx Firebase / FCM / APNs