IndumetrixAcademy
Training/DevOps / SRE/Chapter 3
03Access

Your Day-1 Access

Day one you need access to: GitHub Actions, Vercel, DigitalOcean droplet 157.230.235.15, Docker. The skills that gate this work are `hr-recruiting-manager`, `smart-industry-mcp`, `senzary-mcp`, `alarm-event-auditor`.

Credentials live in repo-local `.env` files (gitignored) and in `/home/user/workspace/credentials/` for agent runs. **Never** print a secret. Never commit a token. Never `cat` a `.env` to chat.

By end of this chapter, you should be able to log into every system listed, name the skill that owns each one, and explain where your credentials are stored.

Teaching Moments

How Eric talks about this

“never print a secret”
— Security rule · session db1de987

Standing directive: secrets live ONLY in repo-local .env files (gitignored). Never cat, echo, or print IOTLOGIQ_JWT_SECRET, THINGSBOARD_PASSWORD, MCP keys, DATABASE_URL, GitHub PAT, Vercel token, or n8n JWT. Never run gh auth status — it leaks the PAT.

“credentials live in /home/user/workspace/credentials/”
— Standing location · session db1de987

For agent runs, credentials live in /home/user/workspace/credentials/. The eric-managed-tools skill is the authoritative inventory. Load it before any task that touches mailboxes or direct APIs.

“favor mcp versus api”
— 2026-04-27 directive · session fba9aafc

Eric's standing rule, verbatim. When an MCP server exists for the system, use it. Don't drop down to raw API calls unless the MCP is missing the tool you need.

Prompts referenced

Try these exact phrasings

Hands-on

Try it yourself

List every system you have access to from the DevOps / SRE required-systems list (GitHub Actions, Vercel, DigitalOcean droplet 157.230.235.15, Docker). For each: paste a screenshot URL or record URL proving access. Note any system where access is missing — that's a day-1 ticket.

Pass criteria
  • lists every required-system from the track
  • every accessible system has a URL or screenshot
  • any missing access is named explicitly
Self-check

Quick check

  1. 1. Where do secrets live in Senzary projects?

    • a. In Confluence pages
    • b. In repo-local .env files (gitignored)
    • c. In Slack DMs
    • d. In the README
    Reveal answer

    Standing rule: secrets must live ONLY in repo-local .env files (gitignored). Never print, cat, or commit secrets.

  2. 2. Which skill is the authoritative inventory of Eric's mailbox credentials?

    • a. agenda-manager
    • b. eric-managed-tools
    • c. commercial-manager
    • d. senzary-mcp
    Reveal answer

    eric-managed-tools holds the inventory of all personal/Senzary mailbox credentials not reachable via Perplexity built-in connectors.

  3. 3. Why never run `gh auth status`?

    • a. It's slow
    • b. It leaks the PAT
    • c. It's deprecated
    • d. It requires sudo
    Reveal answer

    gh auth status prints the GitHub PAT to stdout. Standing rule: never run it. Use gh CLI commands directly with the PAT in env.

← Back to DevOps / SRE← Chapter 2Chapter 4 →

Built 2026-07-31 · 3 teaching moments · 3 prompts