# Secrets (encrypted secret store + `${secret:}` resolution)

Normalizes how the family stores and consumes secrets — SQL/login passwords, API-key HMAC
peppers, LDAP bind passwords, connection strings, TLS material — which are handled ad-hoc
and inconsistently across the three apps today (Data-Protection-encrypted connection
strings in ScadaBridge; peppers/passwords in environment variables; LDAP passwords in
`appsettings`).

The goal is the shared **`ZB.MOM.WW.Secrets`** library: AES-256-GCM envelope encryption at
rest, a pluggable master-key provider and store, an audited `ISecretResolver` +
`${secret:name}` config expander for app runtime, and a Blazor `/admin/secrets` management
UI. The library is **built, published (0.1.2), and live-proven** via its reference consumer;
per-app adoption is the tracked follow-on.

- **Target:** [`spec/SPEC.md`](spec/SPEC.md)
- **Realized API:** [`shared-contract/ZB.MOM.WW.Secrets.md`](shared-contract/ZB.MOM.WW.Secrets.md)
- **Implementation:** [`../../ZB.MOM.WW.Secrets/`](../../ZB.MOM.WW.Secrets/) · design [`docs/plans/2026-07-15-secrets-manager-design.md`](../../docs/plans/2026-07-15-secrets-manager-design.md)
- **Adoption backlog:** [`GAPS.md`](GAPS.md)

## Status

| | State |
|---|---|
| Library | **Built + published** — `ZB.MOM.WW.Secrets{,.Abstractions,.Ui}` 0.1.2 on the `dohertj2-gitea` feed; `.Cli` in-repo (not packed); `.Akka` replicator **deferred** (design only) |
| Reference consumer | **HistorianGateway — adopted + live-proven** (2026-07-16): historian password sourced via `${secret:}`, authenticated read against the real wonder historian |
| Three sister apps | **Not yet adopted** — see per-app current-state + GAPS |

## Per-project current state

| Project | Today (baseline) | Doc |
|---|---|---|
| OtOpcUa | _(code-verified baseline)_ | [`current-state/otopcua/CURRENT-STATE.md`](current-state/otopcua/CURRENT-STATE.md) |
| MxAccessGateway | _(code-verified baseline)_ | [`current-state/mxaccessgw/CURRENT-STATE.md`](current-state/mxaccessgw/CURRENT-STATE.md) |
| ScadaBridge | _(code-verified baseline)_ | [`current-state/scadabridge/CURRENT-STATE.md`](current-state/scadabridge/CURRENT-STATE.md) |

> Not applicable as a fourth adopter row but the exemplar: **HistorianGateway** already
> consumes the lib — its wiring is the template the three apps follow (see the
> shared-contract "Consumer wiring" section).