infisical-secrets-managerlisted

# Infisical secrets manager — fleet credential migration Self-hosted Infisical (VM 111 `infisical`, `192.168.50.29`, `https://infisical.tail922cee.ts.net`), project `homelab-fleet` (ID `4655aace-2e75-4c2a-8d29-9bd438868396`), environment `dev`, path `/` for everything unless a specific reason exists to use a folder. Built and fully rolled out 2026-09-02 across `ansible-ctrl`, `pbs`, `n8n`, `immich`, `dfw`, and Claude Code's own interactive Cloudflare admin tokens (30 secrets total) — see `project_infisical_secrets_manager` memory for the full incident-by-incident history. This skill is the durable "how," not the narrative. **Not the same as Agent Vault.** Agent Vault (also Infisical, separate product) is a MITM proxy that injects credentials into an *agent's own outbound API calls* at the network layer. This skill's Infisical is a real secrets *store* — a scoped, authenticated pull of one named value. Genuinely independent products, no shared backend. Don't conflate deployment steps between them. ## Before migrating anything: verify it's real and still live Two real findings this session, both caught by verifying instead of assuming: - **A `.env` file existing doesn't mean it holds a real secret.** `pihole-exporter.env` looked like a normal credential file (right permissions, right shape) but held only explanatory comments — Pi-hole's password auth had been disabled months earlier, so the exporter had been running unauthenticated by design the whole time. A first-p