| Secret Name | Purpose | Example Value | Where Used | |-------------|---------|---------------|------------| | FIRECRAWL_API_KEY | Web scraping service API key | fc-9e8a47f30432410aa1a3cf0dc4cddc76 | Backend CI/CD, Production | | JWT_SECRET | JWT token signing key | your-super-secret-jwt-key-min-256-bits | Backend CI/CD, Production | | POSTGRES_PASSWORD | Production database password | strong-random-password-here | Production deployment | | MAIL_PASSWORD | SMTP email password | smtp-password-here | Production email service | | REDIS_PASSWORD | Redis cache password | redis-password-here | Production caching | | MINIO_ROOT_PASSWORD | MinIO object storage password | minio-root-password-here | Production file storage |

🚀 Deployment Secrets

| Secret Name | Purpose | Example Value | Where Used | |-------------|---------|---------------|------------| | VPS_HOST | VPS server IP/hostname | 136.144.174.219 | Deployment workflow | | VPS_USERNAME | SSH username | deploy | Deployment workflow | | VPS_SSH_KEY | SSH private key | -----BEGIN RSA PRIVATE KEY-----... | Deployment workflow | | DOCKER_USERNAME | Docker registry username | glorylabs | Docker image push | | DOCKER_PASSWORD | Docker registry password | docker-registry-token | Docker image push |

🛠️ How to Configure Secrets

Step 1: Navigate to Repository Settings

Go to your GitHub repository
Click Settings (top right)
In the left sidebar, click Secrets and variables → Actions

Step 2: Add Each Secret

For each secret listed above:

Click New repository secret
Enter the Name (exactly as shown above)
Enter the Value (the actual secret)
Click Add secret

🔐 Generating Secure Values

JWT_SECRET

Generate a secure random string (minimum 256 bits):

# Option 1: Using OpenSSL
openssl rand -base64 64

# Option 2: Using Node.js
node -e "console.log(require('crypto').randomBytes(64).toString('base64'))"

# Option 3: Using Python
python3 -c "import secrets; print(secrets.token_urlsafe(64))"

Example output:

xK9mP2nQ5tR8vW1yA4bC6dE7fG0hI3jL5mN8pO9qS2uV4xY6zA1bD3eF5gH7iJ9kL0mN2oP4qR6sT8uV0wX2yZ

Database Passwords

Generate strong random passwords:

# Generate a 32-character password
openssl rand -base64 32

# Generate multiple passwords
for i in {1..5}; do openssl rand -base64 24; done

SSH Key for Deployment

Generate SSH key pair:

# Generate new SSH key
ssh-keygen -t ed25519 -C "glorylabs-deploy" -f ~/.ssh/glorylabs_deploy

# Copy private key (this goes in VPS_SSH_KEY secret)
cat ~/.ssh/glorylabs_deploy

# Copy public key (this goes on VPS server)
cat ~/.ssh/glorylabs_deploy.pub

Add public key to VPS:

# On VPS server
mkdir -p ~/.ssh
echo "ssh-ed25519 AAAA..." >> ~/.ssh/authorized_keys
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys

📝 Current API Keys

Firecrawl API Key

Current Value: fc-9e8a47f30432410aa1a3cf0dc4cddc76

Source: Already in use in local development Location: Currently in backend/src/main/resources/application.yml

Action:

Add to GitHub Secrets as FIRECRAWL_API_KEY
Remove from application.yml
Update application.yml to use environment variable:

firecrawl:
  api-key: ${FIRECRAWL_API_KEY:}
  enabled: ${FIRECRAWL_ENABLED:false}

🔄 Using Secrets in GitHub Actions

Secrets are automatically available in workflows:

- name: Run tests
  env:
    FIRECRAWL_API_KEY: ${{ secrets.FIRECRAWL_API_KEY }}
    JWT_SECRET: ${{ secrets.JWT_SECRET }}
  run: ./mvnw test

Current workflows that need secrets:

backend-ci.yml - Needs JWT_SECRET, FIRECRAWL_API_KEY
deploy-production.yml - Needs all deployment secrets
integration.yml - Needs JWT_SECRET, FIRECRAWL_API_KEY

🏗️ Environment Variables in Production

Docker Compose (Production)

Create .env file on VPS (DO NOT commit to Git):

# Backend Configuration
JWT_SECRET=your-jwt-secret-here
FIRECRAWL_API_KEY=fc-9e8a47f30432410aa1a3cf0dc4cddc76
FIRECRAWL_ENABLED=true

# Database
POSTGRES_DB=recruitment_production
POSTGRES_USER=recruitment
POSTGRES_PASSWORD=your-postgres-password

# Redis
REDIS_PASSWORD=your-redis-password

# MinIO
MINIO_ROOT_USER=admin
MINIO_ROOT_PASSWORD=your-minio-password

# Email
MAIL_USERNAME=noreply@interimplaza.nl
MAIL_PASSWORD=your-email-password
MAIL_HOST=smtp.gmail.com
MAIL_PORT=587

# Application
SPRING_PROFILES_ACTIVE=production
APP_URL=https://platform.interimplaza.nl
API_URL=https://api.interimplaza.nl

Deploying Secrets to VPS

# Upload .env file securely
scp .env deploy@136.144.174.219:/opt/glorylabs/.env

# Set permissions
ssh deploy@136.144.174.219
chmod 600 /opt/glorylabs/.env
chown deploy:deploy /opt/glorylabs/.env

✅ Verification Checklist

After configuring secrets:

[ ] All 11 secrets added to GitHub repository
[ ] JWT_SECRET is minimum 64 characters (256 bits)
[ ] All passwords are strong and unique
[ ] SSH key pair generated for deployment
[ ] Public key added to VPS ~/.ssh/authorized_keys
[ ] Private key added to GitHub as VPS_SSH_KEY
[ ] .env file created on VPS (not committed to Git)
[ ] Secrets verified in test workflow run

Test Secrets Configuration

Run a test workflow to verify secrets:

# Trigger backend CI workflow manually
gh workflow run backend-ci.yml

Check logs for:

✅ No "secret not found" errors
✅ Environment variables populated
✅ Tests pass with secrets

🔒 Security Best Practices

✅ Do:

✅ Use GitHub Secrets for all sensitive data
✅ Rotate secrets regularly (every 90 days)
✅ Use strong, random passwords (minimum 32 characters)
✅ Use different passwords for each service
✅ Enable 2FA on all service accounts
✅ Limit secret access to necessary workflows only

❌ Don't:

❌ Commit secrets to Git (even in private repos)
❌ Share secrets in Slack/Email/Discord
❌ Reuse passwords across services
❌ Use weak or predictable passwords
❌ Store secrets in plain text files
❌ Log secrets in application output

📊 Secrets Audit Log

| Secret | Date Added | Last Rotated | Next Rotation | Status | |--------|------------|--------------|---------------|--------| | FIRECRAWL_API_KEY | TBD | - | +90 days | ⏳ To Add | | JWT_SECRET | TBD | - | +90 days | ⏳ To Add | | POSTGRES_PASSWORD | TBD | - | +90 days | ⏳ To Add | | MAIL_PASSWORD | TBD | - | +90 days | ⏳ To Add | | REDIS_PASSWORD | TBD | - | +90 days | ⏳ To Add | | MINIO_ROOT_PASSWORD | TBD | - | +90 days | ⏳ To Add | | VPS_SSH_KEY | TBD | - | +180 days | ⏳ To Add | | DOCKER_PASSWORD | TBD | - | +90 days | ⏳ To Add |

🔗 Related Documentation

Backend Config: backend/src/main/resources/application.yml
Sprint Tasks: 02-Taken/Sprint-1-Taken.md (BACK-2, BACK-3)
Deployment Guide: 05-Deployment/TransIP-Setup.md
GitHub Actions: .github/workflows/

📞 Support

Questions about secrets configuration?

Check GitHub Docs: https://docs.github.com/en/actions/security-guides/encrypted-secrets
Team documentation: 04-Technisch/Secrets-Management.md

Status: ⏳ PENDING CONFIGURATION

Next Steps:

Generate all secret values using commands above
Add secrets to GitHub repository settings
Create .env file on VPS
Test with workflow run
Mark BACK-2 and BACK-3 as complete ✅

Last Updated: October 7, 2025 Created for: GloryLabs Recruitment Platform

Reacties

Nog geen reacties

Athena — mahmoud-consultancy/archive/old-docs/GITHUB_SECRETS_SETUP.md

🔒 GitHub Secrets Configuration Guide

📋 Required Secrets

🔑 Backend Secrets