Joseph Doherty
e347286f28
Add components/secrets/ (SPEC, realized shared-contract, code-verified current-state for OtOpcUa/mxaccessgw/ScadaBridge, GAPS adoption backlog) and register the Secrets row in CLAUDE.md + components/README.md. The ZB.MOM.WW.Secrets lib is built + published 0.1.2 + reference-consumer-proven (HistorianGateway, live vs the wonder historian); per-app adoption is the tracked follow-on.
39 lines
2.4 KiB
Markdown
39 lines
2.4 KiB
Markdown
# Secrets (encrypted secret store + `${secret:}` resolution)
|
|
|
|
Normalizes how the family stores and consumes secrets — SQL/login passwords, API-key HMAC
|
|
peppers, LDAP bind passwords, connection strings, TLS material — which are handled ad-hoc
|
|
and inconsistently across the three apps today (Data-Protection-encrypted connection
|
|
strings in ScadaBridge; peppers/passwords in environment variables; LDAP passwords in
|
|
`appsettings`).
|
|
|
|
The goal is the shared **`ZB.MOM.WW.Secrets`** library: AES-256-GCM envelope encryption at
|
|
rest, a pluggable master-key provider and store, an audited `ISecretResolver` +
|
|
`${secret:name}` config expander for app runtime, and a Blazor `/admin/secrets` management
|
|
UI. The library is **built, published (0.1.2), and live-proven** via its reference consumer;
|
|
per-app adoption is the tracked follow-on.
|
|
|
|
- **Target:** [`spec/SPEC.md`](spec/SPEC.md)
|
|
- **Realized API:** [`shared-contract/ZB.MOM.WW.Secrets.md`](shared-contract/ZB.MOM.WW.Secrets.md)
|
|
- **Implementation:** [`../../ZB.MOM.WW.Secrets/`](../../ZB.MOM.WW.Secrets/) · design [`docs/plans/2026-07-15-secrets-manager-design.md`](../../docs/plans/2026-07-15-secrets-manager-design.md)
|
|
- **Adoption backlog:** [`GAPS.md`](GAPS.md)
|
|
|
|
## Status
|
|
|
|
| | State |
|
|
|---|---|
|
|
| Library | **Built + published** — `ZB.MOM.WW.Secrets{,.Abstractions,.Ui}` 0.1.2 on the `dohertj2-gitea` feed; `.Cli` in-repo (not packed); `.Akka` replicator **deferred** (design only) |
|
|
| Reference consumer | **HistorianGateway — adopted + live-proven** (2026-07-16): historian password sourced via `${secret:}`, authenticated read against the real wonder historian |
|
|
| Three sister apps | **Not yet adopted** — see per-app current-state + GAPS |
|
|
|
|
## Per-project current state
|
|
|
|
| Project | Today (baseline) | Doc |
|
|
|---|---|---|
|
|
| OtOpcUa | _(code-verified baseline)_ | [`current-state/otopcua/CURRENT-STATE.md`](current-state/otopcua/CURRENT-STATE.md) |
|
|
| MxAccessGateway | _(code-verified baseline)_ | [`current-state/mxaccessgw/CURRENT-STATE.md`](current-state/mxaccessgw/CURRENT-STATE.md) |
|
|
| ScadaBridge | _(code-verified baseline)_ | [`current-state/scadabridge/CURRENT-STATE.md`](current-state/scadabridge/CURRENT-STATE.md) |
|
|
|
|
> Not applicable as a fourth adopter row but the exemplar: **HistorianGateway** already
|
|
> consumes the lib — its wiring is the template the three apps follow (see the
|
|
> shared-contract "Consumer wiring" section).
|