Development Secrets

Secrets inventory (development)

Development Compose uses non-production credentials. Every variable is documented in the repo-root .env.example.

Inventory

Variable family	Purpose in Compose	Default posture
`POSTGRES_*`	Postgres superuser + database name for the running instance	Local-only passwords checked into examples
`CLICKHOUSE_*`	ClickHouse user/password	Local-only
`MINIO_*`	MinIO root user/password	Local-only
`NATS_URL`	JetStream connection string consumed by the gateway, ingest, audit, query, and trace-ingest services	Local-only
`NEXUS_REDIS_URL`	Redis-compatible connection string for the gateway cache/rate limits and the policy decision cache; not set by stock Compose	Local-only
`OTEL_EXPORTER_OTLP_ENDPOINT`	Collector endpoint for Rust services	Points at the in-compose collector

Rules

Never commit real provider keys or customer data. Use .env (gitignored) or your OS secret store.
Rotate dev keys if they ever leave your machine (screen share, log upload, etc.).
Production injection is outside this document — follow your organization’s secret manager (Vault, cloud KMS, etc.).
CI runs against in-repo fixtures; CI job definitions document any required repository secrets in the workflow files themselves.

Rotation

Nexus API keys — mint and revoke via the nexus CLI against your state directory; only a hash is retained after creation.
BYOK provider keys — replace via nexus credentials provider-keys flows; treat leaked keys as compromised with the upstream provider.
PTB platform provider keys — production PTB uses operator-managed keys that are distinct from tenant BYOK rows. Manage them with nexus credentials platform-keys set/list/rm/rotate; use --secret-env, --secret-file, or --secret-stdin for secret material and never paste secrets into shell history.

Example:

nexus credentials platform-keys set \
  --provider openai \
  --secret-env OPENAI_PLATFORM_API_KEY \
  --workspace ws_... \
  --org org_... \
  --label prod-openai-us

nexus credentials platform-keys rotate ppk_... --secret-env OPENAI_PLATFORM_API_KEY_NEXT

Scoped platform keys resolve from most-specific to broadest: project, org, workspace, then the tenant-wide (operator) fallback.

Wallet grants

Workspace PTB balances are funded by auditable operator grants:

nexus ops grants create \
  --workspace ws_... \
  --amount-usd 100.00 \
  --reason "pilot credit" \
  --idempotency-key pilot-credit-001

Grant reasons and idempotency keys are audit metadata. They are not secrets. Auto-refill fields are stored per workspace but not acted on: nothing charges a saved payment method.

Container registry and signing keys

Not used by the default dev stack. When packaging workflows add registry push or image signing, document those secrets next to the workflow that consumes them.