# Docker Secrets Directory
This directory contains sensitive configuration files for Docker secrets.
## Security Guidelines
1. **NEVER commit secret files to version control**
- All `.txt` files in this directory are gitignored
- Only this README should be committed
2. **File Format**
- Each secret should be a plain text file
- File should contain only the secret value (no newlines at the end)
- Use descriptive filenames matching the secret names in docker-compose.yml
## Required Secrets
Create the following files with your actual secret values:
### `anthropic_api_key.txt`
Your Anthropic API key for Claude integration.
Get it from: https://console.anthropic.com
### `hf_token.txt`
Your Hugging Face token for downloading models.
Get it from: https://huggingface.co/settings/tokens
### `mcp_auth_token.txt`
Authentication token for MCP server access.
Generate a secure random token, e.g.:
```bash
openssl rand -hex 32 > mcp_auth_token.txt
```
### `comfyui_auth.txt`
Optional authentication for ComfyUI web interface.
Format: `username:password`
## Creating Secrets
Example commands to create secret files:
```bash
# Create the secrets directory if it doesn't exist
mkdir -p secrets
# Add your Anthropic API key
echo -n "sk-ant-api03-..." > secrets/anthropic_api_key.txt
# Add your Hugging Face token
echo -n "hf_..." > secrets/hf_token.txt
# Generate a random MCP auth token
openssl rand -hex 32 > secrets/mcp_auth_token.txt
# Optional: Add ComfyUI authentication
echo -n "admin:secure_password" > secrets/comfyui_auth.txt
# Set proper permissions (readable only by owner)
chmod 600 secrets/*.txt
```
## Production Deployment
For production environments, consider using:
- Docker Swarm secrets
- Kubernetes secrets
- HashiCorp Vault
- AWS Secrets Manager
- Azure Key Vault
## Environment Variable Fallback
If Docker secrets are not available (e.g., in development), the system will fall back to environment variables:
- `ANTHROPIC_API_KEY`
- `HF_TOKEN`
- `MCP_AUTH_TOKEN`
- `COMFYUI_AUTH`
## Security Best Practices
1. Rotate secrets regularly
2. Use strong, unique tokens
3. Monitor access logs
4. Implement least privilege access
5. Never log secret values
6. Use HTTPS/TLS for all communications
