diff --git a/docs/COMMANDS.md b/docs/COMMANDS.md index 87a9a224..7f7e2179 100644 --- a/docs/COMMANDS.md +++ b/docs/COMMANDS.md @@ -130,7 +130,11 @@ curl -s http:///rpc/v1 -b jar.txt -H 'Content-Type: application/json' \ -d '{"method":"system.stats","params":{}}' ``` -Login returns a `session` cookie. Read-only methods (`system.stats`, `system.get-metrics`, `bitcoin.getinfo`, `monitoring.current`, `bitcoin.relay-status`, `tor.status`) are CSRF-exempt, so the cookie alone is enough; state-changing calls also need the `X-CSRF-Token` header. If TOTP is enabled, follow the login with `auth.login.totp`. +Login returns a `session` cookie. State-changing calls also need the `X-CSRF-Token` header. Exactly twelve read-only methods are CSRF-exempt, so for those the cookie alone is enough: + +`node-messages-received` · `server.echo` · `server.get-state` · `system.stats` · `system.get-settings` · `system.get-node-key` · `system.get-metrics` · `system.get-version` · `tor.status` · `tor.onion-addresses` · `bitcoin.relay-status` · `federation.list-nodes` + +Anything not on that list — including `bitcoin.getinfo` and `monitoring.current` — needs the CSRF header. If TOTP is enabled, follow the login with `auth.login.totp`. --- diff --git a/docs/secrets.md b/docs/secrets.md index 5a761bf3..5009fce5 100644 --- a/docs/secrets.md +++ b/docs/secrets.md @@ -60,8 +60,18 @@ container: ``` At apply time the orchestrator reads `/var/lib/archipelago/secrets/` -and sets `` in the container's environment to its contents. The value is -never written into the manifest, the Quadlet unit, or any log line. +and makes it available in the container as ``. It does **not** do this by +adding `KEY=value` to the environment — that value would show up in +`podman inspect` output and, on the Quadlet path, as a plaintext `Environment=` +line in a unit file on disk. Instead the resolved pairs are registered as podman +secrets named `archy-env--` and referenced by name, so the value +never lands in the manifest, a unit file, `podman inspect`, or a log line. + +**Interpolation taints.** A plain `environment` entry that interpolates a secret +— e.g. BTCPay's `ConnectionString=...Password=${BTCPAY_DB_PASS}` — is treated as +secret-bearing itself and travels the same protected path, rather than being +left in the clear because it was declared under `environment`. So you can build +connection strings from secrets without leaking them. ## How materialisation works