Access & secrets
Secrets stay out of this file
Names of environment variables and Actions secrets are safe to commit. Values are not. The preview on Settings masks anything that still looks like a token.
GitHub read token
The browser never sees this value. Public repos can be read without a token until the rate limit.
- Holds
- Actions and contents read for the repos listed here
- Where
Actions secret GITHUB_TOKEN or a fine-grained PAT in GITHUB_STATUS_TOKEN
SSH keys
The collector writes them to a temp file for the ssh process and deletes them. They are not stored in status JSON.
- Holds
- One private key per machine, plus a pinned known_hosts file
- Where
SSH_KEY_* and SSH_KNOWN_HOSTS
Heartbeat tokens
A token can only identify its own host. Put the receiver on a private network.
- Holds
- One bearer token per host or agent
- Where
HEARTBEAT_TOKEN_* on the reporter and on the receiver
Private network. SSH checks, heartbeat posts, and any admin URL should stay on a private network such as a tailnet or a WireGuard mesh. Do not publish them on the open internet so the dashboard can see them.
Sample data · not live · Oct 20, 4:41 PM CDT