MCP SSH Orchestrator

# example-credentials.yml # # Example SSH credentials configuration for mcp-ssh-orchestrator. # Copy this to config/credentials.yml and customize for your environment. # # SECURITY NOTES: # - Never commit real secrets to Git. # - Mount your private keys into /app/keys (read-only) with chmod 0400. # - Store passwords/passphrases as Docker secrets, .env file, or env vars (see below). # - Secrets are resolved in the following order: # 1. Direct environment variable (Docker MCP Gateway): <SECRET_NAME> # 2. Prefixed environment variable: MCP_SSH_SECRET_<NAME_IN_UPPERCASE> # 3. .env file: /app/secrets/.env (consolidated secrets file) # 4. Docker secret file: /app/secrets/<name> # # Fields: # name : unique identifier referenced by servers.yml (required) # username : SSH username (required) # key_path : private key path relative to /app/keys (or absolute path) # password_secret : secret name containing SSH password (optional) # key_passphrase_secret: secret name containing passphrase for encrypted key (optional) # # Example secret setup: # # Option 1: Using .env file (recommended for consolidated management) # echo "prod_admin_passphrase=super-secret" >> secrets/.env # chmod 600 secrets/.env # # # Option 2: Individual secret files (Docker secrets compatible) # echo "super-secret" > secrets/prod_admin_password.txt # docker secret create prod_admin_password secrets/prod_admin_password.txt # # # Option 3: Environment variable # export MCP_SSH_SECRET_PROD_ADMIN_PASSWORD=super-secret entries: # Production automation account using Ed25519 key (recommended) - name: "prod-admin" username: "ubuntu" key_path: "prod/id_ed25519" key_passphrase_secret: "prod_admin_passphrase" # leave blank if unencrypted password_secret: "" # password auth disabled # Staging deployment user with encrypted RSA key (passphrase pulled from secrets) - name: "stg-deploy" username: "deploy" key_path: "staging/id_rsa_encrypted" key_passphrase_secret: "stg_deploy_key_passphrase" password_secret: "" # Lab maintenance account authenticating with password stored in secret - name: "lab-maint" username: "maint" key_path: "" key_passphrase_secret: "" password_secret: "lab_maint_password" # Example mixed-mode user: password fallback plus passphrase-protected key - name: "ops-fallback" username: "ops" key_path: "shared/id_rsa_encrypted" key_passphrase_secret: "ops_key_passphrase" password_secret: "ops_password"