Sankofa/docs/proxmox/dotenv-review.md

# .env File Review and Recommendations

**Review Date**: 2024-12-19  
**File**: `.env` (49 lines)

## Current Configuration Summary

### Cloudflare Configuration

1. **Global API Key + Email** (Lines 4-6)
   - ✅ Configured: `CLOUDFLARE_API_KEY` and `CLOUDFLARE_EMAIL`
   - ⚠️ **Security Risk**: Global API Key provides full account access
   - 📝 **Recommendation**: Prefer API tokens with limited scope

2. **Origin CA Key** (Line 9)
   - ✅ Configured: `CLOUDFLARE_ORIGIN_CA_KEY`
   - 📝 Used for Cloudflare Origin Certificates
   - ℹ️ Not needed for ACME DNS-01 setup

3. **API Token** (Line 12)
   - ❌ **Missing**: `CLOUDFLARE_API_TOKEN` is commented out
   - 🔴 **Critical for ACME**: Required for Proxmox ACME DNS-01 plugin
   - 📝 **Action Required**: Uncomment and add token

4. **Zone and Account IDs** (Lines 26-28)
   - ✅ Configured: `CLOUDFLARE_ACCOUNT_ID` and `CLOUDFLARE_ZONE_ID`
   - ✅ Domain: `DOMAIN=sankofa.nexus`
   - ✅ Values appear correct

### Proxmox Configuration

1. **Instance 1 (ML110-01)** (Lines 35-36)
   - ✅ Username: `root@pam`
   - ✅ API Token: Configured with proper format
   - ✅ Well-structured

2. **Instance 2 (R630-01)** (Lines 39-40)
   - ✅ Username: `root@pam`
   - ✅ API Token: Configured with proper format
   - ✅ Well-structured

3. **Root Password** (Line 44)
   - ⚠️ **Security Risk**: Plain text password stored
   - 📝 **Recommendation**: Consider using password manager or secrets management

## Critical Issues

### 🔴 Missing: CLOUDFLARE_API_TOKEN for ACME

**Location**: Line 12 (currently commented)

**Impact**: 
- Proxmox ACME DNS-01 plugin requires this token
- Without it, automatic certificate issuance/renewal will fail

**Action Required**:
```env
# Uncomment and add your ACME-specific token
CLOUDFLARE_API_TOKEN=your-acme-dns01-token-here
```

**Token Requirements**:
- Permissions: Zone → DNS → Edit
- Scope: `sankofa.nexus` zone only
- Create at: https://dash.cloudflare.com/profile/api-tokens
- Use "Edit zone DNS" template

### ⚠️ Security: Global API Key Exposure

**Issue**: Global API Key provides full account access if compromised

**Recommendation**: 
1. Use API tokens with limited scope instead
2. If Global API Key is needed, ensure:
   - File has proper permissions (600)
   - Not committed to version control
   - Consider rotating periodically

### ⚠️ Security: Plain Text Password

**Issue**: `PROXMOX_ROOT_PASS` stored in plain text

**Recommendation**:
1. Use API tokens instead (already configured ✅)
2. If password must be stored:
   - Use secrets management (Vault, Kubernetes Secrets)
   - Encrypt the .env file
   - Restrict file permissions (chmod 600 .env)

## Recommendations

### 1. Add Missing ACME Token

Add this after line 12:

```env
# Cloudflare API Token for ACME DNS-01 (Proxmox certificate setup)
# Create token with Zone DNS Edit permissions for sankofa.nexus
CLOUDFLARE_API_TOKEN=your-acme-dns01-token-here
```

### 2. File Permissions

Ensure .env file has restrictive permissions:

```bash
chmod 600 .env
```

### 3. Verify .gitignore

Ensure .env is in .gitignore:

```bash
grep -q "^\.env$" .gitignore && echo "✅ .env in .gitignore" || echo "❌ Add .env to .gitignore"
```

### 4. Token Naming Convention

Consider using descriptive names in comments:

```env
# Cloudflare API Token for ACME DNS-01 (Proxmox Let's Encrypt)
# Token Name: proxmox-acme-dns01
# Scope: sankofa.nexus zone, DNS Edit only
CLOUDFLARE_API_TOKEN=your-token-here
```

### 5. Environment-Specific Files

Consider using:
- `.env.local` for local development
- `.env.production` for production
- `.env.example` as template (without secrets)

## Configuration Completeness Check

### For ACME Setup

- [x] `CLOUDFLARE_ACCOUNT_ID` - ✅ Configured
- [x] `CLOUDFLARE_ZONE_ID` - ✅ Configured
- [x] `DOMAIN` - ✅ Configured (sankofa.nexus)
- [ ] `CLOUDFLARE_API_TOKEN` - ❌ **Missing** (commented out, needs value)

### For Proxmox Integration

- [x] `PROXMOX_TOKEN_ML110_01` - ✅ Configured
- [x] `PROXMOX_TOKEN_R630_01` - ✅ Configured
- [x] `PROXMOX_USERNAME_ML110_01` - ✅ Configured
- [x] `PROXMOX_USERNAME_R630_01` - ✅ Configured

## Suggested .env Structure

```env
# =============================================================================
# Cloudflare Configuration
# =============================================================================

# Cloudflare Global API Key (legacy - prefer API tokens)
CLOUDFLARE_API_KEY=e5153f7f2dcf64fec7f25ede78c15482bc950
CLOUDFLARE_EMAIL=pandoramannli@gmail.com

# Cloudflare API Token for ACME DNS-01 (Proxmox Let's Encrypt certificates)
# Token Name: proxmox-acme-dns01
# Permissions: Zone DNS Edit (sankofa.nexus only)
# Create at: https://dash.cloudflare.com/profile/api-tokens
CLOUDFLARE_API_TOKEN=your-acme-dns01-token-here

# Cloudflare Account and Zone IDs
CLOUDFLARE_ACCOUNT_ID=52ad57a71671c5fc009edf0744658196
CLOUDFLARE_ZONE_ID=13e2c26acc5eda15eafa7c8735b00239
DOMAIN=sankofa.nexus

# Cloudflare Origin CA Key (for Origin Certificates)
CLOUDFLARE_ORIGIN_CA_KEY=v1.0-40220c19a24f6e2980fb37b0-...

# =============================================================================
# Proxmox Configuration
# =============================================================================

# Instance 1 (ML110-01) - Admin Node
PROXMOX_USERNAME_ML110_01=root@pam
PROXMOX_TOKEN_ML110_01=root@pam!sankofa-instance-1-api-token=73c7e1a2-...

# Instance 2 (R630-01) - VM/Compute Node
PROXMOX_USERNAME_R630_01=root@pam
PROXMOX_TOKEN_R630_01=root@pam!sankofa-instance-2-api-token=d0d45212-...

# Root Password (consider using secrets management instead)
PROXMOX_ROOT_PASS=L@KERS2010

# Proxmox Endpoints (optional - defaults to FQDNs)
# PROXMOX_ENDPOINT_ML110_01=https://ml110-01.sankofa.nexus:8006
# PROXMOX_ENDPOINT_R630_01=https://r630-01.sankofa.nexus:8006
```

## Security Checklist

- [ ] `.env` file permissions set to 600
- [ ] `.env` in `.gitignore`
- [ ] No secrets committed to version control
- [ ] API tokens use minimal required permissions
- [ ] Consider rotating Global API Key periodically
- [ ] Use API tokens instead of Global API Key where possible
- [ ] Consider using secrets management for sensitive values

## Next Steps

1. **Immediate**: Add `CLOUDFLARE_API_TOKEN` for ACME setup
2. **Security**: Review and rotate Global API Key if possible
3. **Best Practice**: Use API tokens with limited scope
4. **Documentation**: Document token purposes in comments
5. **Monitoring**: Set up alerts for token expiration/rotation

## Related Documentation

- [ACME Setup Guide](./acme-setup.md) - Complete ACME certificate setup
- [ACME Commands](./acme-commands.md) - Command reference
- [ENV Examples](../ENV_EXAMPLES.md) - Environment variable examples