secrets: pre-stage GEMINI_API_KEY_DW_ENRICH route (empty) for leaked-key rotation — instant fan on Steve's new key

ac2d3d81ea5adb97270773ad9d274c8a27823672 · 2026-06-23 17:36:21 -0700 · Steve

Files touched

M routes.json

Diff

commit ac2d3d81ea5adb97270773ad9d274c8a27823672
Author: Steve <steve@designerwallcoverings.com>
Date:   Tue Jun 23 17:36:21 2026 -0700

    secrets: pre-stage GEMINI_API_KEY_DW_ENRICH route (empty) for leaked-key rotation — instant fan on Steve's new key
---
 routes.json | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/routes.json b/routes.json
index 73e0331..f64f6a9 100644
--- a/routes.json
+++ b/routes.json
@@ -635,6 +635,29 @@
         }
       ]
     },
+    "GEMINI_API_KEY_DW_ENRICH": {
+      "label": "Google Gemini API Key — DEDICATED to DW image-enrichment / vendor-command-center. Created 2026-06-23 by vp-security as the rotation target for the leaked orphan keys (last-4 ejMo and S2ic, never registry-managed). Pre-staged EMPTY so that the moment Steve issues a fresh key at Google AI Studio, `add GEMINI_API_KEY_DW_ENRICH <new-key>` verifies it against Gemini and fans it (remapped to the bare var GEMINI_API_KEY) to the consumers below. Distinct from the master GEMINI_API_KEY (Letsbegin/Bertha/skills) and GEMINI_API_KEY_WALLCO (k720). If Steve prefers enrichment to ride the master key instead, he can skip this alias and update GEMINI_API_KEY directly — the env-ified consumers read GEMINI_API_KEY first.",
+      "verify": {
+        "method": "GET",
+        "url": "https://generativelanguage.googleapis.com/v1beta/models?key={value}",
+        "auth": "url"
+      },
+      "_note": "The 3 DW vendor-command-center files (logo-cropper.js, website-scorer.js, standardization-worker.js) read process.env.GEMINI_API_KEY (master) with GEMINI_KEY fallback, loaded from /root/.env on Kamatera. The goodquestion-ai/scripts/generate-hero-images.cjs reads process.env.GEMINI_API_KEY from ~/Projects/goodquestion-ai/.env. Each destination remaps this alias to the bare key name GEMINI_API_KEY so the env-ified code picks it up with no further change.",
+      "destinations": [
+        {
+          "type": "project",
+          "host": "45.61.58.125",
+          "user": "root",
+          "path": "/root/.env",
+          "key": "GEMINI_API_KEY"
+        },
+        {
+          "type": "env_file",
+          "path": "~/Projects/goodquestion-ai/.env",
+          "key": "GEMINI_API_KEY"
+        }
+      ]
+    },
     "GEMINI_API_KEY_WALLCO": {
       "label": "Google Gemini API Key — DEDICATED to wallco.ai gen pipeline (nano-banana / gemini-2.5-flash-image fallback). Distinct from the master GEMINI_API_KEY (Letsbegin/Bertha/skills). Same dedicated-alias pattern as GEMINI_API_KEY_RALPH.",
       "verify": {

← 201ce58 auto-save: 2026-06-23T12:21:34 (1 files) — registry.json · back to Secrets Manager · auto-save: 2026-06-24T12:57:01 (1 files) — registry.json bc755b5 →