221 lines
6.6 KiB
Markdown
221 lines
6.6 KiB
Markdown
# .env File Review and Recommendations
|
||
|
||
**Review Date**: 2024-12-19
|
||
**File**: `.env` (49 lines)
|
||
|
||
## Current Configuration Summary
|
||
|
||
### Cloudflare Configuration
|
||
|
||
1. **Global API Key + Email** (Lines 4-6)
|
||
- ✅ Configured: `CLOUDFLARE_API_KEY` and `CLOUDFLARE_EMAIL`
|
||
- ⚠️ **Security Risk**: Global API Key provides full account access
|
||
- 📝 **Recommendation**: Prefer API tokens with limited scope
|
||
|
||
2. **Origin CA Key** (Line 9)
|
||
- ✅ Configured: `CLOUDFLARE_ORIGIN_CA_KEY`
|
||
- 📝 Used for Cloudflare Origin Certificates
|
||
- ℹ️ Not needed for ACME DNS-01 setup
|
||
|
||
3. **API Token** (Line 12)
|
||
- ❌ **Missing**: `CLOUDFLARE_API_TOKEN` is commented out
|
||
- 🔴 **Critical for ACME**: Required for Proxmox ACME DNS-01 plugin
|
||
- 📝 **Action Required**: Uncomment and add token
|
||
|
||
4. **Zone and Account IDs** (Lines 26-28)
|
||
- ✅ Configured: `CLOUDFLARE_ACCOUNT_ID` and `CLOUDFLARE_ZONE_ID`
|
||
- ✅ Domain: `DOMAIN=sankofa.nexus`
|
||
- ✅ Values appear correct
|
||
|
||
### Proxmox Configuration
|
||
|
||
1. **Instance 1 (ML110-01)** (Lines 35-36)
|
||
- ✅ Username: `root@pam`
|
||
- ✅ API Token: Configured with proper format
|
||
- ✅ Well-structured
|
||
|
||
2. **Instance 2 (R630-01)** (Lines 39-40)
|
||
- ✅ Username: `root@pam`
|
||
- ✅ API Token: Configured with proper format
|
||
- ✅ Well-structured
|
||
|
||
3. **Root Password** (Line 44)
|
||
- ⚠️ **Security Risk**: Plain text password stored
|
||
- 📝 **Recommendation**: Consider using password manager or secrets management
|
||
|
||
## Critical Issues
|
||
|
||
### 🔴 Missing: CLOUDFLARE_API_TOKEN for ACME
|
||
|
||
**Location**: Line 12 (currently commented)
|
||
|
||
**Impact**:
|
||
- Proxmox ACME DNS-01 plugin requires this token
|
||
- Without it, automatic certificate issuance/renewal will fail
|
||
|
||
**Action Required**:
|
||
```env
|
||
# Uncomment and add your ACME-specific token
|
||
CLOUDFLARE_API_TOKEN=your-acme-dns01-token-here
|
||
```
|
||
|
||
**Token Requirements**:
|
||
- Permissions: Zone → DNS → Edit
|
||
- Scope: `sankofa.nexus` zone only
|
||
- Create at: https://dash.cloudflare.com/profile/api-tokens
|
||
- Use "Edit zone DNS" template
|
||
|
||
### ⚠️ Security: Global API Key Exposure
|
||
|
||
**Issue**: Global API Key provides full account access if compromised
|
||
|
||
**Recommendation**:
|
||
1. Use API tokens with limited scope instead
|
||
2. If Global API Key is needed, ensure:
|
||
- File has proper permissions (600)
|
||
- Not committed to version control
|
||
- Consider rotating periodically
|
||
|
||
### ⚠️ Security: Plain Text Password
|
||
|
||
**Issue**: `PROXMOX_ROOT_PASS` stored in plain text
|
||
|
||
**Recommendation**:
|
||
1. Use API tokens instead (already configured ✅)
|
||
2. If password must be stored:
|
||
- Use secrets management (Vault, Kubernetes Secrets)
|
||
- Encrypt the .env file
|
||
- Restrict file permissions (chmod 600 .env)
|
||
|
||
## Recommendations
|
||
|
||
### 1. Add Missing ACME Token
|
||
|
||
Add this after line 12:
|
||
|
||
```env
|
||
# Cloudflare API Token for ACME DNS-01 (Proxmox certificate setup)
|
||
# Create token with Zone DNS Edit permissions for sankofa.nexus
|
||
CLOUDFLARE_API_TOKEN=your-acme-dns01-token-here
|
||
```
|
||
|
||
### 2. File Permissions
|
||
|
||
Ensure .env file has restrictive permissions:
|
||
|
||
```bash
|
||
chmod 600 .env
|
||
```
|
||
|
||
### 3. Verify .gitignore
|
||
|
||
Ensure .env is in .gitignore:
|
||
|
||
```bash
|
||
grep -q "^\.env$" .gitignore && echo "✅ .env in .gitignore" || echo "❌ Add .env to .gitignore"
|
||
```
|
||
|
||
### 4. Token Naming Convention
|
||
|
||
Consider using descriptive names in comments:
|
||
|
||
```env
|
||
# Cloudflare API Token for ACME DNS-01 (Proxmox Let's Encrypt)
|
||
# Token Name: proxmox-acme-dns01
|
||
# Scope: sankofa.nexus zone, DNS Edit only
|
||
CLOUDFLARE_API_TOKEN=your-token-here
|
||
```
|
||
|
||
### 5. Environment-Specific Files
|
||
|
||
Consider using:
|
||
- `.env.local` for local development
|
||
- `.env.production` for production
|
||
- `.env.example` as template (without secrets)
|
||
|
||
## Configuration Completeness Check
|
||
|
||
### For ACME Setup
|
||
|
||
- [x] `CLOUDFLARE_ACCOUNT_ID` - ✅ Configured
|
||
- [x] `CLOUDFLARE_ZONE_ID` - ✅ Configured
|
||
- [x] `DOMAIN` - ✅ Configured (sankofa.nexus)
|
||
- [ ] `CLOUDFLARE_API_TOKEN` - ❌ **Missing** (commented out, needs value)
|
||
|
||
### For Proxmox Integration
|
||
|
||
- [x] `PROXMOX_TOKEN_ML110_01` - ✅ Configured
|
||
- [x] `PROXMOX_TOKEN_R630_01` - ✅ Configured
|
||
- [x] `PROXMOX_USERNAME_ML110_01` - ✅ Configured
|
||
- [x] `PROXMOX_USERNAME_R630_01` - ✅ Configured
|
||
|
||
## Suggested .env Structure
|
||
|
||
```env
|
||
# =============================================================================
|
||
# Cloudflare Configuration
|
||
# =============================================================================
|
||
|
||
# Cloudflare Global API Key (legacy - prefer API tokens)
|
||
CLOUDFLARE_API_KEY=e5153f7f2dcf64fec7f25ede78c15482bc950
|
||
CLOUDFLARE_EMAIL=[email protected]
|
||
|
||
# Cloudflare API Token for ACME DNS-01 (Proxmox Let's Encrypt certificates)
|
||
# Token Name: proxmox-acme-dns01
|
||
# Permissions: Zone DNS Edit (sankofa.nexus only)
|
||
# Create at: https://dash.cloudflare.com/profile/api-tokens
|
||
CLOUDFLARE_API_TOKEN=your-acme-dns01-token-here
|
||
|
||
# Cloudflare Account and Zone IDs
|
||
CLOUDFLARE_ACCOUNT_ID=52ad57a71671c5fc009edf0744658196
|
||
CLOUDFLARE_ZONE_ID=13e2c26acc5eda15eafa7c8735b00239
|
||
DOMAIN=sankofa.nexus
|
||
|
||
# Cloudflare Origin CA Key (for Origin Certificates)
|
||
CLOUDFLARE_ORIGIN_CA_KEY=v1.0-40220c19a24f6e2980fb37b0-...
|
||
|
||
# =============================================================================
|
||
# Proxmox Configuration
|
||
# =============================================================================
|
||
|
||
# Instance 1 (ML110-01) - Admin Node
|
||
PROXMOX_USERNAME_ML110_01=root@pam
|
||
PROXMOX_TOKEN_ML110_01=root@pam!sankofa-instance-1-api-token=73c7e1a2-...
|
||
|
||
# Instance 2 (R630-01) - VM/Compute Node
|
||
PROXMOX_USERNAME_R630_01=root@pam
|
||
PROXMOX_TOKEN_R630_01=root@pam!sankofa-instance-2-api-token=d0d45212-...
|
||
|
||
# Root Password (consider using secrets management instead)
|
||
PROXMOX_ROOT_PASS=L@KERS2010
|
||
|
||
# Proxmox Endpoints (optional - defaults to FQDNs)
|
||
# PROXMOX_ENDPOINT_ML110_01=https://ml110-01.sankofa.nexus:8006
|
||
# PROXMOX_ENDPOINT_R630_01=https://r630-01.sankofa.nexus:8006
|
||
```
|
||
|
||
## Security Checklist
|
||
|
||
- [ ] `.env` file permissions set to 600
|
||
- [ ] `.env` in `.gitignore`
|
||
- [ ] No secrets committed to version control
|
||
- [ ] API tokens use minimal required permissions
|
||
- [ ] Consider rotating Global API Key periodically
|
||
- [ ] Use API tokens instead of Global API Key where possible
|
||
- [ ] Consider using secrets management for sensitive values
|
||
|
||
## Next Steps
|
||
|
||
1. **Immediate**: Add `CLOUDFLARE_API_TOKEN` for ACME setup
|
||
2. **Security**: Review and rotate Global API Key if possible
|
||
3. **Best Practice**: Use API tokens with limited scope
|
||
4. **Documentation**: Document token purposes in comments
|
||
5. **Monitoring**: Set up alerts for token expiration/rotation
|
||
|
||
## Related Documentation
|
||
|
||
- [ACME Setup Guide](./acme-setup.md) - Complete ACME certificate setup
|
||
- [ACME Commands](./acme-commands.md) - Command reference
|
||
- [ENV Examples](../ENV_EXAMPLES.md) - Environment variable examples
|
||
|