scadaproj/components/secrets/current-state/scadabridge/CURRENT-STATE.md

ScadaBridge — secrets current state

Descriptive baseline (code-verified) of how ScadaBridge handles secrets today, before adopting ZB.MOM.WW.Secrets. Paths are relative to ~/Desktop/ScadaBridge.

Where each secret lives today

Secret	Location today	At-rest protection
MSSQL ConfigDb password	ScadaBridge:Database:ConfigurationDb connstr (Host/Program.cs:221-223); committed dev plaintext docker/central-node-a/appsettings.Central.json:21	Plaintext
Central dbo MachineDataDb password	ScadaBridge:Database:MachineDataDb (StartupValidator.cs:63-65; appsettings.Central.json:22)	Plaintext
Site SQLite	SiteDbPath / StoreAndForward SqliteDbPath (appsettings.Site.json:26,34) — plain file paths	None (no SQLCipher)
LDAP service-account password	ScadaBridge:Security:Ldap:ServiceAccountPassword via ZB.MOM.WW.Auth.Ldap (Program.cs:140-142); committed serviceaccount123 appsettings.Central.json:32 (+ loose ldap_login.txt etc. at repo root)	Plaintext
Inbound /api keys	Hashed (peppered-HMAC) in SQLite data/inbound-api-keys.sqlite via ZB.MOM.WW.Auth.ApiKeys (Program.cs:184-217); legacy SQL-Server key store retired (20260602092753_RetireInboundApiKeyStore)	Hashed (not reversible)
API-key pepper	ScadaBridge:InboundApi:ApiKeyPepper (InboundAPI/InboundApiOptions.cs:23-36); committed dev dev-only-insecure-pepper-… docker/docker-compose.yml:18,45 (both central nodes share)	Plaintext env
JWT signing key	ScadaBridge:Security:JwtSigningKey (HS256, Security/SecurityOptions.cs:34); appsettings.Central.json:38	Plaintext
DatabaseConnectionDefinition.ConnectionString	ConfigDb column	Encrypted (Data Protection — see below)
MxGateway per-endpoint ApiKey	Inside DataConnection.PrimaryConfiguration/BackupConfiguration JSON in ConfigDb; column mapped without the encrypting converter (ConfigurationDatabase/Configurations/SiteConfiguration.cs:52-56)	Plaintext in ConfigDb (redacted for display/audit only, ConfigSecretScrubber.cs:18-19)
Akka remoting	HOCON AkkaHostedService.cs:250-308 — hostname/port only	No secure-cookie / no TLS / no shared secret (plain TCP)

Encryption-at-rest today (the one existing analog)

• EncryptedStringConverter (ASP.NET Core Data Protection EF value converter, ConfigurationDatabase/EncryptedStringConverter.cs:20-52, purpose "…ConfigurationDatabase.EncryptedColumn") encrypts four ConfigDb columns (ScadaBridgeDbContext.cs:319-348): SmtpConfiguration.Credentials, SmsConfiguration.AuthToken, ExternalSystemDefinition.AuthConfiguration, DatabaseConnectionDefinition.ConnectionString.
• Key ring lives in ConfigDb (IDataProtectionKeyContext + DataProtectionKeys, AddDataProtection().PersistKeysToDbContext<ScadaBridgeDbContext>()) — shared across central nodes. No SetApplicationName (discriminator = content-root path) and no ProtectKeysWith* — the key-ring keys are stored unencrypted in the DB; the DB is the only protection boundary.

Config expansion today

• None functional. Stock AddJsonFile+AddEnvironmentVariables+AddCommandLine (Program.cs:38-43). The ${SCADABRIDGE_*} tokens in appsettings.Central.json:23,33,35 are literal, non-functional placeholders — the real values arrive by whole-key env override (ScadaBridge__Security__Ldap__ServiceAccountPassword, etc.), documented in the _secrets note (appsettings.Central.json:21). StartupValidator (ConfigPreflight from the shared ZB.MOM.WW.Configuration package) validates presence/shape only — no resolution.

Adoption plan (toward SPEC)

1. Formalize the existing placeholders: the non-functional ${SCADABRIDGE_*} + whole-key-override convention is exactly the pattern ${secret:} replaces — swap the plaintext ConfigDb/MachineDataDb passwords, LDAP password, JWT signing key, and pepper to ${secret:…} tokens resolved pre-host, before StartupValidator/ConfigPreflight runs. Delete the committed dev plaintext + the loose *_login.txt files.
2. Close the MxGateway ApiKey plaintext-in-ConfigDb gap — either extend EncryptedStringConverter to that JSON column or resolve it via ISecretResolver.
3. Clustered sync: ScadaBridge is Akka-clustered (central pair + site nodes). Two SPEC- sanctioned options: (a) point ISecretStore at the shared ConfigDb (SQL-Server store) — one source of truth, mirrors how the Data-Protection key ring is already shared; or (b) adopt the ZB.MOM.WW.Secrets.Akka replicator (built on adoption) with a shared KEK (FileMasterKeyProvider, same mounted key on every node — hard requirement).
4. UI: mount /admin/secrets in CentralUI; map ScadaBridge's admin role onto the policies.
5. Keep bespoke: the existing Data-Protection column encryption can coexist (or migrate); the peppered-HMAC inbound-key SQLite store stays (already hashed). Akka remoting auth/TLS is a separate hardening concern, not this component.