# Dev-box credentials Use Pharos DX or Make to retrieve a selected service password from your dev box. The commands use `TARGET` and `SSH` from your checkout's `.env`. No password goes into `.env`, a new local vault or the deployment log. ## In Pharos DX 1. Install the [current preview](desktop/README.md#install-pharos-dx) and connect your checkout in **Settings**. Older installers need updating to show this page. 2. Open **Credentials** and check the displayed dev-box name. 3. Find the account under Sign-in, Databases, Messaging and cache, Service credentials or Administrator access. The list shows account names and notes. 4. Choose **Copy** to paste the password into your client, or **Reveal** to display it briefly. Each action reads the current value from the dev box. Copy runs in the native app; the password does not pass through the webview. Reveal clears automatically after 30 seconds and when you leave the page or hide the window. Copy attempts to clear the clipboard after 30 seconds, provided its contents still match. Clipboard managers may keep their own history. Passwords are absent from Activity, status, tray updates and diagnostic logs. ## In a terminal Run these commands from your checkout on the workstation: ```sh make credentials # List entries without passwords make credentials COPY=waldur.staff # Copy the selected password make credentials SHOW=postgres.execution-core # Reveal it in this terminal ``` Choose the ID printed by `make credentials`. Common entries include: | ID | Account | |---|---| | `pharos.operator` | Pharos web operator access code | | `aai.user.alice` / `aai.user.bob` | Default shared AAI test accounts | | `waldur.staff` | Waldur staff account | | `argocd.admin` | Argo CD initial administrator password | | `gitlab.root` | GitLab initial root password | | `ceph.admin` | Ceph dashboard administrator | | `postgres.execution-core` | Execution Core database user | | `postgres.waldur` / `postgres.gitlab` | Waldur and GitLab database users | | `postgres.admin` | Shared PostgreSQL administrator | | `rabbitmq.waldur` | Waldur broker user | | `valkey.pharos` | Pharos session cache user | The complete list also includes the other context databases, broker users, OIDC clients and service API keys. Prefer the scoped account for the service you are inspecting. Listing entries describes supported selectors; it does not prove every optional component is installed. `SHOW` requires an interactive terminal and refuses redirected output. It writes only to that terminal. Avoid terminal recording or screen sharing while revealing a password. `COPY` sends the value directly to the clipboard tool, without placing it in a command argument or environment variable. The CLI does not clear clipboard history; replace the clipboard contents when finished. CLI clipboard access uses `pbcopy` on macOS, `clip.exe` in WSL, `wl-copy` on Wayland or `xclip` on X11. Install `wl-clipboard` or `xclip` if your Linux desktop lacks the matching tool. Pharos DX uses its native clipboard integration. Run `make urls` for application links and access instructions. Password retrieval uses SSH and needs no browser forward, Docker engine or local Kubernetes context. It does not open database ports or change credentials. ## Requirements and recovery Use an installed dev box, workstation SSH access with a verified host key, and the saved target/cluster binding created by setup or takeover. The workstation needs uv and OpenSSH; the dev box needs Python 3, k3s and passwordless sudo. These are covered by the [setup prerequisites](GUIDE.md#prerequisites). Missing dependencies produce instructions without including provider output or secret values. Retrieval refuses a changed cluster identity or a target under maintenance. Finish setup/reset and refresh the page before trying again. After replacing a VM, run the reviewed setup flow to establish its new binding. Never bypass host-key verification to retrieve credentials. An **initial** administrator password can become obsolete after a manual password change, and its bootstrap Secret may have been deleted. The command reports an unavailable entry when its source is absent; it never resets an account. Use the service's own recovery procedure if the stored initial password no longer works. Other accounts can also diverge from their generated Secret if changed directly in the service. Retrieval reads the stored Secret; it does not authenticate the account or repair that difference. Default AAI users can be disabled by private identity overrides. ## Access boundary This is operator access using your existing SSH and sudo permissions. Only named password/API-key selectors are supported; there is no arbitrary Secret export, private-key download or persistent password cache. Generated Kubernetes Secrets remain authoritative, so later retrieval observes their replacement or rotation. An explicit Reveal or Copy makes that selected value available to your user session. Terminal recording, screenshots, clipboard history and software running with your filesystem permissions can retain it. Treat your workstation and dev box as trusted administration environments. ## Verification The focused Python tests exercise rejected selectors, SSH identity checks, bounded output, sanitised failures and the terminal/clipboard paths using fixture values. Desktop tests cover the separate IPC channel, expiry and workspace changes. The [native and UI commands](desktop/README.md#build-and-verify) run independently of an installed dev box. The live credential checker reads the selected dev box and prints only entry IDs and pass/fail results. It checks that diagnostic log files stay unchanged. No password is printed, copied to the clipboard or saved. Run it in a quiet workspace so another operation does not change those logs during the check. ```sh uv run --project devops --frozen python dx/common/tests/credential_access_check.py ``` All listed entries must be available for this full-stack check. To qualify a partial installation or one account, append `--id waldur.staff`; repeat `--id` for additional entries. Missing/deleted initial passwords fail only their selected entries and remain an account-recovery concern. On 19 October 2026, all 32 entries passed against the existing dev box, with diagnostic logs unchanged. The native macOS reader also passed a live read. Repository verification, 21 focused Python tests, 14 Rust tests and 50 light/dark UI cases passed. UI tests use synthetic IPC values. Native Windows/WSL2 and Linux interaction remains unqualified. PostgreSQL integration, application-browser integration, manual UAT, Minikube, fresh k3s setup and full deployment were not rerun for this read-only workstation change.