Password Management

Which credentials exist, where they live, and how to keep terraform.tfvars safe.

Which credentials exist?

Credential	Purpose	Storage
Hetzner API Token	Create infrastructure	`terraform.tfvars`
Root password	Emergency web console	`terraform.tfvars`
SSH private keys	Server access	`~/.ssh/` or password manager
Cloudflare Tunnel token	Tunnel auth	Cloudflare Dashboard

Recommended Dashlane structure

📁 K8s Cluster
├── 🔐 Hetzner API Token
│   └── Token: xxx
├── 🔐 Root Password
│   └── Password: xxx
├── 📝 SSH Keys (Secure Note)
│   ├── Control Node Private Key: ...
│   ├── Control Node Public Key: ...
│   ├── Worker Node Private Key: ...
│   └── Worker Node Public Key: ...
└── 🔐 Cloudflare Tunnel Token
    └── Token: xxx

Securing terraform.tfvars

terraform.tfvars contains sensitive data. Options:

Do not commit: exclude via .gitignore (default)
Encrypt: with git-crypt or sops

Use environment variables instead of tfvars:

export TF_VAR_hcloud_token="xxx"
export TF_VAR_root_password="xxx"