Secrets Management & Google Secret Manager Catalog

The GERCIA Platform strictly enforces a Zero-Trust Secrets Policy. No credentials, connection strings, private certificates, or API tokens are ever hardcoded in source code, committed to the Git repository, or stored in static configuration files (appsettings.json).

All production and staging credentials reside exclusively in Google Secret Manager (GSM) and are injected into application memory at runtime.

1. Zero-Trust Secrets Lifecycle Architecture

flowchart TD
    subgraph GSM ["Google Secret Manager (GSM) - Multi-Region Encrypted Storage"]
        SEC_CF["Cloudflare Tokens & Service Access Keys"]
        SEC_DB["PostgreSQL Connection Strings (PRD/STG)"]
        SEC_CRYPTO["GERCIA_APP_ENCRYPTION_KEY (AES-256-GCM)"]
        SEC_IAM["Google Workspace OIDC & Mailgun Keys"]
        SEC_WH["Google Chat Notification Webhooks"]
    end

    subgraph CONSUMERS ["Secret Consumers & Runtime Execution Environments"]
        subgraph GCB ["Google Cloud Build CI/CD (southamerica-east1)"]
            P_BUILD["cloudbuild.*.yaml<br>(availableSecrets.secretManager)"]
        end

        subgraph GCP_COMPUTE ["Google Cloud Platform (Serverless Compute - Cloud Run)"]
            HOST_SERVER["Gercia.Server (Cloud Run Service • REST, OpenIddict STS, MCP)"]
            HOST_JOB["gercia-migrator (Cloud Run Job • DDL Migrations via --migrate)"]
        end

        subgraph LOCAL ["Local Developer Stations"]
            DEV_SECRETS["dotnet user-secrets<br>(Secrets ID in csproj)"]
        end
    end

    GSM -- "Injected during build & deploy steps" --> GCB
    GSM -- "Fetched into memory on container bootstrap" --> HOST_SERVER & HOST_JOB
    LOCAL -. "Local isolated development" .-> DEV_SECRETS

2. Official Google Secret Manager Inventory (14 Platform Secrets)

The platform operates 14 authoritative secret keys in Google Secret Manager, categorized into 5 operational domains:

A. Cloudflare Zero Trust & Deployment Infrastructure

Secret Key	Description	Consumer(s)	Lifecycle & Rotation
`CF_ACCOUNT_ID`	Cloudflare enterprise account identifier used for Pages and Access configurations.	Cloud Build (`cloudbuild.docs.yaml`, `cloudbuild.site.yaml`)	Static account reference
`CF_API_TOKEN`	Scoped Cloudflare API token allowing `npx wrangler pages deploy` to publish static portals.	Cloud Build (`docs`, `site`)	Rotated periodically via Cloudflare Dashboard

B. Database Credentials & Connection Strings

The server connects over Server TLS 1.3 (ssl=on, hostssl) with individual 64-character high-entropy passwords hashed via SCRAM-SHA-256. Connection strings are stored securely in GSM and enriched dynamically at startup with NpgsqlConnectionStringBuilder parameters (Pooling=true, MinPoolSize=5, MaxPoolSize=80, Timeout=15, Timezone=UTC, SslMode=Require).

Secret Key	Target Database Cluster	Consumer Service	Target Environment
`CONNECTION_STRING_SERVER_PRD`	`gercia-db-prd` (Google Cloud SQL)	`Gercia.Server` (Cloud Run Service)	Production
`CONNECTION_STRING_SERVER_STG`	`gercia-db-stg` (Google Cloud SQL)	`Gercia.Server` (Cloud Run Service)	Staging
`CONNECTION_STRING_MIGRATOR_PRD`	`gercia-db-prd` (Google Cloud SQL)	`gercia-migrator` (Cloud Run Job)	Production
`CONNECTION_STRING_MIGRATOR_STG`	`gercia-db-stg` (Google Cloud SQL)	`gercia-migrator` (Cloud Run Job)	Staging

C. Master Encryption & Sensitive Data Protection

Secret Key	Purpose & Algorithm	Consumed By	Security Level
`GERCIA_APP_ENCRYPTION_KEY`	Master symmetric key for Column-Level Encryption (CLE) of patient CPFs and clinical notes via AES-256-GCM.	`Gercia.Server`	Critical (Zero-Knowledge PHI/PII)

D. IAM, Licensing & Third-Party SaaS

Secret Key	Description	Consumer Service	Purpose
`GOOGLE_CLIENT_ID_OPS`	Google Workspace OAuth 2.0 Client ID restricted to the `@gercia.com.br` hosted domain.	`Gercia.Server` (STS Ops challenge)	Internal Staff SSO (`ops.gercia.com.br`)
`GOOGLE_CLIENT_SECRET_OPS`	Google Workspace OAuth 2.0 Client Secret paired with `GOOGLE_CLIENT_ID_OPS`.	`Gercia.Server` (STS Ops challenge)	Internal Staff SSO (`ops.gercia.com.br`)
`MAILGUN_API_KEY`	API Key for Mailgun transactional email delivery.	`Gercia.Server`	Verification emails, password resets, e-prescriptions
`MAILGUN_DOMAIN`	Verified sending domain configured in Mailgun (e.g., `mg.gercia.com.br`).	`Gercia.Server`	Email envelope sender
`GEMINI_API_KEY`	Google Gemini API Key for Commercial AI Assistant inference.	Cloudflare Pages (`apps/site` Edge Functions)	Commercial Assistant and Conversational AI

E. Observability, Alerting & Chat Webhooks

Secret Key	Destination Webhook Target	Notification Types
`WEBHOOK_GERCIA_DEVSECOPS`	Google Chat: `🛡️ devsecops`	CI/CD build completions, ancestry gate tag alerts, Docker image promotions, deployment notifications, and test failures.
`WEBHOOK_GERCIA_INCIDENTS`	Google Chat: `🚨 incidents`	Production unhandled exceptions, database connection pool exhaustion, edge disconnection alerts, and operational outages.

3. Local Developer Setup (User Secrets)

Developers working locally on workstation machines must never store production secrets in local configuration files. Secrets for local debugging are managed via the .NET Secret Manager CLI (dotnet user-secrets):

# Configure Google Workspace SSO credentials for Backoffice local debugging
dotnet user-secrets set "GOOGLE_CLIENT_ID_OPS" "<LOCAL_DEV_CLIENT_ID>" \
  --project dotnet/src/Hosts/Gercia.Server/Gercia.Server.csproj

dotnet user-secrets set "GOOGLE_CLIENT_SECRET_OPS" "<LOCAL_DEV_CLIENT_SECRET>" \
  --project dotnet/src/Hosts/Gercia.Server/Gercia.Server.csproj

# Configure AES-256 Master Encryption Key for Column-Level Encryption (CLE)
dotnet user-secrets set "GERCIA_APP_ENCRYPTION_KEY" "<LOCAL_DEV_KEY_BASE64>" \
  --project dotnet/src/Hosts/Gercia.Server/Gercia.Server.csproj