ophix-creds

One place to store fleet secrets, instead of one more copy in every server's .env file.

If your deploy scripts and server configs have ended up with database passwords, API keys, and other secrets copied onto every host that happens to need them, ophix-creds gives your fleet one central place to store them instead. Clients fetch a named secret on demand over HTTPS — authenticated with a per-client token and IP check — and hold it in memory only; nothing is written to disk or cached locally on the client side.

Access is granted per client, per credential: a client can be given read, update, delete, or no access at all to any given secret, and any grant can be revoked instantly without touching the credential itself. Secrets are encrypted at rest on the server.

Installation

See installation.md for the full step-by-step guide — service user, TLS setup, the guided installer, and getting the service running under nginx and systemd.

Routine upgrades

The guided installer generates ophixcredserver-update.sh (Step 4 in installation.md) — a single script that checks for and installs package updates, then runs migrate, collectstatic, generate_config --append (picks up any new .env settings automatically), refreshes documentation, and refreshes the Plugin Versions table. Run it as the service user, not root:

./ophixcredserver-update.sh

It finishes by printing a reminder to restart the service — it doesn't restart it for you. If you ever move the venv or change INSTALL_DIR, re-run ophix-manage create_update_script first to regenerate the script with the new paths.

What this plugin provides

• Credential model — named JSON secret with enabled flag
• ClientCredential join model — per-client permissions (enabled, can_update, can_delete, can_share)
• GET/POST/PUT/DELETE /api/credentials/<name>/ API endpoints
• Django admin with inline ClientCredential management and linked-artifact columns
• Access audit logging via ophix.core.audit
• Built-in documentation (loaded by update_docs if ophix-docs is installed)

Configuration (.env)

Client

Fleet clients use ophix-cred-client to authenticate and fetch credentials.

Documentation

If ophix-docs is installed, documentation is loaded automatically during run_install. To load or refresh docs manually after an upgrade:

ophix-manage update_docs --include-app-docs ophix.core,ophix_creds,ophix_docs

See ophix-docs for the full list of documentation management commands.