Track how access is managed across all infrastructure and services.
| Host |
Method |
Account |
Notes |
| Altair (Unraid) |
SSH |
[email protected] |
Password auth; Nova key being re-authorized |
| Edward (Proxmox) |
SSH |
[email protected] |
Key auth verified |
| Edward (Proxmox) |
API |
nova@pve!automation |
Dedicated API token for Nova |
| Service |
Admin Account |
Auth Method |
| Wiki.js |
[email protected] |
Local password |
| Immich |
— |
Local accounts (managed in-app) |
| Nextcloud |
— |
Local accounts (managed in-app) |
| Vaultwarden |
— |
Bitwarden-compatible auth; admin via separate token |
| n8n |
— |
X-N8N-API-KEY for API access |
| Open WebUI |
— |
Local accounts (in SQLite) |
| Duplicacy |
Web UI |
Local web login |
- Proxmox: nova@pve!automation token (PROXMOX_CREDENTIALS.md)
- Unraid: Nova API key (UNRAID_CREDENTIALS.md)
- Gitea: API token managed during setup
- Wiki.js: JWT obtained via GraphQL login mutation (WIKIJS_CREDENTIALS.md)
- Vaultwarden public exposure: Confirm Nginx Proxy Manager has rate limiting and brute-force protection on the Vaultwarden proxy host.
- SSH key authorization: Nova SSH key for Altair needs to be re-authorized (key was regenerated today).
- Credential consolidation: Credentials are spread across PROXMOX_CREDENTIALS.md, UNRAID_CREDENTIALS.md, WIKIJS_CREDENTIALS.md, B2_BACKUP_CREDENTIALS.md, and UNRAID_DEPLOYMENTS.md. Consider consolidating or at least having an index.
- 2FA status: Confirm which services have 2FA enabled and which are password-only. Vaultwarden on a public URL without enforced 2FA is a risk.
- Credential rotation schedule: No documented rotation policy for any of the API keys or admin passwords.
- Service account naming: Some services use generic admin accounts. Consider standardizing naming for auditability.