From 12f8a37dc40bdd9f6bc1defe2963e6e3568e565a Mon Sep 17 00:00:00 2001
From: n0mad1k <n0mad1k@localhost>
Date: Wed, 25 Mar 2026 06:20:37 -0400
Subject: [PATCH] Use dedicated net-alerter Matrix service account, keep
 credentials out of repo

---
 .gitignore            |  1 +
 net_alerter/deploy.sh | 15 +++++++++++----
 2 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/.gitignore b/.gitignore
index c73077c..b757195 100644
--- a/.gitignore
+++ b/.gitignore
@@ -9,3 +9,4 @@ __pycache__/
 *.pcap
 *.pcap.zst
 *.pcap.zst.enc
+net_alerter/.secrets
diff --git a/net_alerter/deploy.sh b/net_alerter/deploy.sh
index 60a54cb..9ea8476 100755
--- a/net_alerter/deploy.sh
+++ b/net_alerter/deploy.sh
@@ -8,15 +8,22 @@ SSH_ALIAS="condo"
 REMOTE_DIR="/opt/net_alerter"
 SCRIPT="$(dirname "$0")/net_alerter.py"
 
-# Matrix access token — get fresh one if not passed
+# Matrix access token for net-alerter service account
+# Get fresh token if not passed — credentials stored in secrets file
+SECRETS_FILE="$(dirname "$0")/.secrets"
 if [[ -n "${1:-}" ]]; then
   TOKEN="$1"
-else
-  echo "[*] Fetching Matrix access token..."
+elif [[ -f "$SECRETS_FILE" ]]; then
+  # shellcheck source=/dev/null
+  source "$SECRETS_FILE"
+  echo "[*] Fetching Matrix access token for net-alerter..."
   TOKEN=$(curl -s -X POST https://m.example.org/_matrix/client/v3/login \
     -H "Content-Type: application/json" \
-    -d '{"type":"m.login.password","identifier":{"type":"m.id.user","user":"spectre"},"password":"spectre-cfe6b5f9dd10dd31a204e4a7"}' \
+    -d "{\"type\":\"m.login.password\",\"identifier\":{\"type\":\"m.id.user\",\"user\":\"net-alerter\"},\"password\":\"${NET_ALERTER_MATRIX_PASS}\"}" \
     | python3 -c "import sys,json; print(json.load(sys.stdin)['access_token'])")
+else
+  echo "[error] Pass a token as \$1 or create $(dirname "$0")/.secrets with NET_ALERTER_MATRIX_PASS=..."
+  exit 1
 fi
 
 echo "[*] Deploying to $SSH_ALIAS..."