Protect connections and secrets

The Server is your trust boundary only if the infrastructure and the material that unlocks it are treated as part of that boundary.

Secret red lines

• Never commit deploy.toml, instance.env, provider keys, recovery codes, owner credentials, bootstrap tokens, or private SSH identities.
• Never paste them into an issue, pull request, support transcript, screenshot, or command line that will be retained in shell history.
• Keep deploy.toml and managed instance.env at mode 0600; keep their containing directories private to the operator account.
• Keep profiles non-secret. nautilo profile current is designed to be safe to inspect, not to become a secret vault.
• Treat a recovery bundle as secret-bearing operational material even though nautilo backup verify redacts its report.

Bootstrap authority expires

A first-install bootstrap token authorizes setup. It is not the durable day-two authority for remote Compose operation. Remote lifecycle changes are authorized through the configured SSH identity and Docker privilege.

The signed administrator CLI does not expose the source client's doctor cleanup commands. Do not copy them into a packaged-install workflow or delete bootstrap directories by guesswork. Keep retained setup material protected; ask the administrator responsible for that installation to identify consumed material and its recovery obligations before any cleanup.

Rotation is a complete operation

For any provider or connection secret:

1. create the replacement at the provider;
2. update it through the owning Nautilo configuration path;
3. prove the affected capability with the old credential still available for recovery;
4. revoke the old credential at the provider; and
5. confirm logs, backups, screenshots, and shell history did not capture it.

Nautilo does not turn third-party provider administration into a single universal rotation command. The provider remains one side of the transaction.