Protect connections and secrets

The Server is your trust boundary only if the infrastructure and the material that unlocks it are treated as part of that boundary.

Secret red lines

• Never commit deploy.toml, instance.env, provider keys, recovery codes, owner credentials, bootstrap tokens, or private SSH identities.
• Never paste them into an issue, pull request, support transcript, screenshot, or command line that will be retained in shell history.
• Keep deploy.toml and managed instance.env at mode 0600; keep their containing directories private to the operator account.
• Keep profiles non-secret. nautilo profile current is designed to be safe to inspect, not to become a secret vault.
• Treat a recovery bundle as secret-bearing operational material even though nautilo backup verify redacts its report.

Bootstrap authority expires

A first-install bootstrap token authorizes setup. It is not the durable day-two authority for remote Compose operation. Remote lifecycle changes are authorized through the configured SSH identity and Docker privilege.

Where an installation contains consumed bootstrap material, inspect before purging:

nautilo doctor purge-consumed-bootstrap --dry-run
nautilo doctor purge-consumed-bootstrap

The command only targets consumed bootstrap trees whose .used sentinel is older than 24 hours. A dry run is still the correct first move.

Rotation is a complete operation

For any provider or connection secret:

1. create the replacement at the provider;
2. update it through the owning Nautilo configuration path;
3. prove the affected capability with the old credential still available for recovery;
4. revoke the old credential at the provider; and
5. confirm logs, backups, screenshots, and shell history did not capture it.

Nautilo does not turn third-party provider administration into a single universal rotation command. The provider remains one side of the transaction.