Access Keys¶

Access Keys authenticate data plane requests (SO, MQ, Secrets).

Create a key¶

Console → IAM → Access Keys → Create
Choose permissions (*, so:*, mq:*, etc.)
Copy Access Key ID (HCAK…) and Secret (shown once)

Configure the CLI¶

InteractiveEnvironment variablesPer commandImport JSON

homecloud configure

export HOMECLOUD_ACCESS_KEY_ID=HCAK...
export HOMECLOUD_SECRET_ACCESS_KEY=...
export HOMECLOUD_APEX=holab.abrdns.com

homecloud --access-key-id HCAK... --secret-access-key ... so ls media

homecloud configure import credentials.json

Warning

Never commit secrets to git. Use GitHub Actions secrets for CI/CD.

Redis cache and homelab restarts¶

Postgres is the source of truth for access keys. Redis is a disposable cache.

After a homelab restart or Redis flush:

The API rehydrates keys on startup
SO/MQ/Secrets rebuild cache on first request via an internal ensure call
Run homelab-resync.sh on the host for a full manual rehydrate

Keys created before the secret_encrypted migration cannot be recovered — revoke and recreate them. See Access Keys security model.

Policy example (SO deploy)¶

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["so:ListBucket", "so:PutObject", "so:DeleteObject"],
      "Resource": [
        "arn:holab:so:::my-website",
        "arn:holab:so:::my-website/*"
      ]
    }
  ]
}