JC Beasley
6ad8772e48
Documents how to: - Authenticate with AppRole - Read secrets from kv/data/api/ - Use service-specific roles for limited access - Locate credential files
108 lines
2.9 KiB
Markdown
108 lines
2.9 KiB
Markdown
# TOOLS.md - Local Notes
|
|
|
|
Skills define _how_ tools work. This file is for _your_ specifics — the stuff that's unique to your setup.
|
|
|
|
## What Goes Here
|
|
|
|
Things like:
|
|
|
|
- Camera names and locations
|
|
- SSH hosts and aliases
|
|
- Preferred voices for TTS
|
|
- Speaker/room names
|
|
- Device nicknames
|
|
- Anything environment-specific
|
|
|
|
## Examples
|
|
|
|
```markdown
|
|
### Cameras
|
|
|
|
- living-room → Main area, 180° wide angle
|
|
- front-door → Entrance, motion-triggered
|
|
|
|
### SSH
|
|
|
|
- home-server → 192.168.1.100, user: admin
|
|
|
|
### TTS
|
|
|
|
- Preferred voice: "Nova" (warm, slightly British)
|
|
- Default speaker: Kitchen HomePod
|
|
```
|
|
|
|
## Why Separate?
|
|
|
|
Skills are shared. Your setup is yours. Keeping them apart means you can update skills without losing your notes, and share skills without leaking your infrastructure.
|
|
|
|
---
|
|
|
|
Add whatever helps you do your job. This is your cheat sheet.
|
|
|
|
## Related
|
|
|
|
- [Agent workspace](/concepts/agent-workspace)
|
|
|
|
---
|
|
|
|
## Beawit Vault (beavault)
|
|
|
|
**URL:** https://beavault.beawit.net:8200
|
|
**Purpose:** Centralized secret management for all API tokens, credentials, and sensitive configuration
|
|
|
|
### Accessing Vault
|
|
|
|
Vault uses AppRole authentication. Credentials are stored in:
|
|
- `/home/jcbeasley/Documents/vault-approles.txt`
|
|
|
|
### Authentication
|
|
|
|
```bash
|
|
# Get vault token using automation role
|
|
curl -sk -X POST \
|
|
-d '{"role_id":"75d2dcfb-9c65-7f60-59b4-eee8c7f8dc0e","secret_id":"6202b465-2f25-547c-ec07-f47cfc4dda3e"}' \
|
|
"https://beavault.beawit.net:8200/v1/auth/approle/login" | jq -r '.auth.client_token'
|
|
```
|
|
|
|
### Reading Secrets
|
|
|
|
```bash
|
|
VAULT_TOKEN="<token_from_above>"
|
|
curl -sk -H "X-Vault-Token: $VAULT_TOKEN" \
|
|
"https://beavault.beawit.net:8200/v1/kv/data/api/<category>/<key>"
|
|
```
|
|
|
|
### Vault Structure
|
|
|
|
Secrets are organized under `kv/data/api/`:
|
|
|
|
| Category | Contents |
|
|
|----------|----------|
|
|
| `ai-ml` | DeepSeek, Groq, OpenRouter, Mistral, etc. |
|
|
| `infrastructure` | NocoDB, Metabase, Qdrant, Odoo, Gitea, etc. |
|
|
| `integration` | N8N, HomeAssistant, Skybox, Tavily |
|
|
| `business` | Stripe, Apollo, Hunter, Kimai, InvoiceNinja |
|
|
| `external` | Email, SnipeIT, FreePBX, SearXNG |
|
|
| `communication` | Discord, Twitter, Uptime Kuma |
|
|
| `monitoring` | Uptime Kuma, SpeedTracker |
|
|
| `search` | SerpAPI, Firecrawl, ImageRouter |
|
|
| `media` | Pexels, YouTube, Freepik, JSON2Video |
|
|
| `credentials` | DB configs, collection names, paths |
|
|
|
|
### Service-Specific Access
|
|
|
|
For read-only access to specific paths, use the appropriate service role:
|
|
|
|
- `svc-ai-ml` - AI/ML services
|
|
- `svc-infrastructure` - Infrastructure services
|
|
- `svc-business` - Business services
|
|
- `svc-communication` - Communication services
|
|
- `svc-monitoring` - Monitoring services
|
|
- `svc-media` - Media services
|
|
- `svc-search` - Search services
|
|
- `svc-integration` - Integration services
|
|
- `svc-external` - External services
|
|
- `svc-credentials` - Credential configs
|
|
|
|
See `/home/jcbeasley/Documents/vault-approles.txt` for role IDs and secret IDs.
|