# Secrets — NOT COMMITTED

Copy this file to `secrets.local.md` and fill it in. That name is git-ignored
(`*.local.md` in `.gitignore`); this template is not, so **never put a real
value in this file**.

Everything here is referenced from the repo by *location*, never inlined.

---

## OpenPLC Runtime v4 REST API

Host `yau-sls-poc-lin001`, `https://10.0.0.17:8443` — self-signed cert, so
clients need `-k` / accept-on-first-connect.

| | |
|---|---|
| Username | `admin` |
| Password | `<fill in>` |

Used by: the OpenPLC Editor when connecting to the runtime (`03-plc/DEPLOY.md`
§B3), and by any direct `POST /api/login` for a JWT.

> The password and the JWT secret travel inside the container volume
> (`restapi.db` and `.env`). A migrated container keeps the same credentials —
> see `MIGRATION.md` Appendix 2.

## Yokogawa CI Server

Host `yau-poc-cicore1`, `10.0.0.21`.

| | |
|---|---|
| Username | `<fill in>` |
| Password | `<fill in>` |

## SSH to the Linux host

The key is a **file**, not a value to paste here:

    ~/.ssh/yau-sls-poc-lin001_key.pem      chmod 600, or SSH refuses it

Obtain it from the host owner over a secure channel. Never commit it — the
`.gitignore` blocks `*.pem`, but do not rely on that alone.

## Not this project's secrets

Host-level credentials — Grafana, InfluxDB, Authelia, Portainer, Forgejo admin
logins and API tokens — belong to the host owner and live in their
`Linux Machine Config.txt`. Ask for them; do not copy them into this repo.