operator-token-runbook: add a credential inventory (every token the agent and apps hold, where it lives, who rotates)

Drafted from the public code and docs, so names and roles only, never
values. Blank cells are for the operator to fill in. Marks the credentials
held by more than one app, which are the ones most likely to break on
rotation. Offered on co-op/support#17.

operator-token-runbook.md

@@ -133,3 +133,70 @@ email" problem — it is not; verify the scope first.)
 revoked). Fix: re-add the `email` scope to the token on Open Collective
 (Settings → Developers → Personal Tokens). No token rotation, no re-granting of
 admin — just the scope.
+
+## Credential inventory (draft, 2026-10-26)
+
+Every credential the agent and the member-facing apps hold, compiled from the
+public code and docs. **No secret values appear here, only names and roles.**
+"Where it lives" and "Who rotates" are filled in where the docs say; blank
+cells are for the operator to complete. When rotating anything, check every
+row that names the same credential: several are held by more than one app.
+
+### Member portal (`portal.inference.coop`)
+
+| Credential | Purpose | Where it lives | Who rotates | Notes |
+|---|---|---|---|---|
+| `CLOUDRON_TOKEN` (portal token) | Create users and groups, invite links | Portal app env | GM | See "The two-token split" above |
+| `OC_PERSONAL_TOKEN` | Read members and orders from Open Collective GraphQL | Portal app env | The Open Collective account that minted it | Needs the `email` scope (see below). Currently a personal token; a co-op-owned OC account would make it a co-op credential |
+| `WEBHOOK_TOKEN` | Secret in the Open Collective webhook URL | Portal app env, and the webhook URL on Open Collective | GM | Rotating means re-creating the webhook on OC as well |
+| `LITELLM_MASTER_KEY` | Create gateway teams and keys for members | Portal app env (copy of the gateway's) | GM | Also held by the gateway; rotate both together |
+| `LITELLM_DB_*` | Read spend logs from the gateway database | Portal app env | Cloudron (addon) | Postgres credentials for the gateway's database |
+| `MATRIX_BOT_TOKEN` | `@inference-bot:inference.coop` admin account: invites, space membership | Portal app env | GM | The account has no password; the token is the only credential |
+| `LOOMIO_API_KEY`, `LOOMIO_B3_KEY` | Forum (Loomio) membership sync | Portal app env | GM | |
+| `LISTMONK_API_USER`, `LISTMONK_API_TOKEN` | Newsletter list sync | Portal app env | GM | |
+| `OWUI_API_KEY`, `OWUI_JWT_SECRET` | Open WebUI knowledge refresh and SSO | Portal app env | GM | Chat moved to LibreChat in October; confirm whether still needed, and retire if not |
+| `BROKER_SECRET` | Shared secret between the portal and the member dashboard | Portal and dashboard app env | GM | Held by both; rotate together |
+| `PORTAL_SECRET` | Session signing | Portal app env | GM | |
+| `CLOUDRON_MAIL_SMTP_*` | Outbound mail | Cloudron mail addon | Cloudron | Managed by the platform |
+
+### Gateway (`gateway.inference.coop`)
+
+| Credential | Purpose | Where it lives | Who rotates | Notes |
+|---|---|---|---|---|
+| `LITELLM_MASTER_KEY` | Gateway admin | `/app/data/.master_key`, exported into the litellm process by `start.sh` | GM | Also held by the portal (above) and the audio keep-alive job |
+| Salt key (`SALT_KEY_FILE`) | Encrypts provider keys stored in the gateway database | `/app/data` | GM | Losing it means re-entering every provider key |
+| `TINFOIL_API_KEY` | Provider account | Gateway app env | Provider account owner | Billing lives at the provider |
+| `GREENPT_API_KEY` | Provider account | Gateway app env | Provider account owner | Billing lives at the provider |
+| `REGOLO_API_KEY` | Provider account | Gateway app env | Provider account owner | Billing lives at the provider |
+| `CLOUDRON_POSTGRESQL_*`, `CLOUDRON_REDIS_*` | Database and cache | Cloudron addons | Cloudron | Managed by the platform |
+
+### Agent (inferencebot, on the agent VPS)
+
+| Credential | Purpose | Where it lives | Who rotates | Notes |
+|---|---|---|---|---|
+| Cloudron agent token | Cloudron API | Agent `.env` | GM | See "The two-token split" above |
+| Gitea token | Commits, issues, PRs as `inference-bot` | Agent `.env` | GM | |
+| Matrix access token (`@inferencebot:inference.coop`) | Reading and posting in rooms | Agent host, with its E2EE key store | GM | The off switch in [Working with the agent](working-with-the-agent.md) revokes this second |
+| Gateway virtual key | The agent's own inference | Agent `.env` | GM | Model allowlist and budget live on this key; the off switch revokes it first |
+| Direct provider key (fallback) | Inference during a gateway outage | Agent `.env` | Provider account owner | Planned on co-op/support#17 |
+| LibreChat admin credential | Per-member key sync job | Agent `.env` | GM | Inferred from the job list on #17 |
+| Restic repository passphrase | Nightly encrypted backup of the agent's state | Agent host and the co-op vault | GM | Per #17 |
+| Infomaniak Swiss Backup S3 keys (agent) | Backup target | Agent host | Infomaniak account owner | Per #17 |
+
+### Accounts (not tokens, but the things tokens come from)
+
+| Account | Purpose | Owner today | Notes |
+|---|---|---|---|
+| Cloudron admin (`my.inference.coop`) | Everything on the main server | | |
+| Hostinger | Hosts the main Cloudron server | Personal account (co-op/support#2) | Moving to Infomaniak |
+| Infomaniak | Agent VPS, Swiss Backup S3 for Cloudron and the agent | | S3 keys for Cloudron backups rotated after setup (co-op/support#12) |
+| Open Collective (collective admins) | Dues, webhooks, the personal token above | | |
+| Provider accounts (Tinfoil, GreenPT, Regolo) | Billing and API keys | | |
+| Domain registrar and DNS for `inference.coop` | | | |
+| Gitea, Matrix, Loomio, Listmonk admin accounts | Service administration | | Cloudron SSO where applicable |
+
+### Keeping this current
+
+Add a row when a new integration lands, and strike one when a service is
+retired. A credential held by two apps is the thing most likely to break on
+rotation; the "Notes" column marks each one.