Secrets sweep: move hardcoded credentials out of tracked files into env files

Removed live secret literals from git-tracked code (all were on GitHub):

- deploy/reactor.py: Claude/Groq API keys, DB pass, Gmail/iCloud app passwords now from os.environ (loaded via systemd EnvironmentFile=/etc/jarvis-arc/reactor.env, root:www-data 0640)

- public_html/login.php: used a private hardcoded PDO connection; now uses config.php DB_* constants

- deploy/jarvis-backup.sh (runs via cron), jarvis-deploy.sh, jarvis-watchdog.sh: DB pass now sourced from /etc/jarvis/db.env (root:root 0600)

- removed dead agent/jarvis-arc-reactor.py (unreferenced old duplicate leaking an old Groq key + stale Ollama IP)

- added deploy/reactor.env.example and deploy/db.env.example templates

Verified live: reactor restarted with all 21 handlers + DB poller (job round-trip OK), login works, mysqldump auth via env OK.

NOTE: these keys remain in GitHub history and should be rotated (Claude/Groq/Gmail/iCloud/DB). Separate decision needed on INFRASTRUCTURE-REFERENCE.md (full cred doc still tracked) + history purge.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

deploy/db.env.example

@@ -0,0 +1,3 @@
+# Copy to /etc/jarvis/db.env (root:root 0600). Sourced by the root cron scripts
+# (jarvis-backup.sh, jarvis-deploy.sh, jarvis-watchdog.sh).
+JARVIS_DB_PASS=your-db-password

deploy/jarvis-backup.sh

@@ -1,4 +1,5 @@
 #!/bin/bash
+[ -r /etc/jarvis/db.env ] && . /etc/jarvis/db.env
 # JARVIS backup — DB dump + all files needed to actually restore JARVIS, as tar.gz
 # Fixed 2026-07-07: this only ever backed up the MySQL database. If this VM were
 # lost, the DB alone is useless without the application code, the reactor daemon,
@@ -9,7 +10,7 @@ LOG="$BACKUP_DIR/backup.log"
 LOCK="$BACKUP_DIR/backup.lock"
 DB_NAME="jarvis_db"
 DB_USER="jarvis_user"
-DB_PASS="J4rv1s_Pr0t0c0l_2026!"
+DB_PASS="${JARVIS_DB_PASS:?DB pass unset - see /etc/jarvis/db.env}"
 TIMESTAMP=$(date +"%Y%m%d_%H%M%S")
 OUTFILE="$BACKUP_DIR/jarvis_backup_${TIMESTAMP}.tar.gz"
 TMPDIR=$(mktemp -d)

deploy/jarvis-deploy.sh

@@ -1,4 +1,5 @@
 #!/bin/bash
+[ -r /etc/jarvis/db.env ] && . /etc/jarvis/db.env
 # JARVIS Auto-Deploy Runner — processes GitHub webhook queue every minute.
 # Validates PHP syntax before deploying; auto-reverts on bad code.
 # Restarts OLS after JARVIS deploys to pick up PHP changes.
@@ -64,7 +65,7 @@ while IFS= read -r path; do
         fi
         # Insert alert into JARVIS DB
         BAD_ESCAPED=$(printf '%s' "$BAD_FILE" | sed "s/'/\\\\\\'/g")
-        mysql -u jarvis_user -pJ4rv1s_Pr0t0c0l_2026! jarvis_db -se \
+        mysql -u jarvis_user -p"$JARVIS_DB_PASS" jarvis_db -se \
             "INSERT INTO alerts (alert_type,title,message,severity)
              VALUES ('deploy_fail','Deploy reverted: syntax error',
              'PHP syntax error in $BAD_ESCAPED. Commit $AFTER was reverted and force-pushed to GitHub.','critical');" 2>/dev/null

deploy/jarvis-watchdog.sh

@@ -1,11 +1,12 @@
 #!/bin/bash
+[ -r /etc/jarvis/db.env ] && . /etc/jarvis/db.env
 # JARVIS Self-Healing Watchdog — runs every 5 min via root cron
 # Checks: lsws, mysql, redis, JARVIS HTTP, disk, memory
 # Auto-heals: restarts failed services, restarts offline Proxmox VM agents
 # Logs to: /home/jarvis.orbishosting.com/logs/watchdog.log
 
 LOG=/home/jarvis.orbishosting.com/logs/watchdog.log
-MYSQL="mysql -u jarvis_user -pJ4rv1s_Pr0t0c0l_2026! jarvis_db -se"
+MYSQL="mysql -u jarvis_user -p$JARVIS_DB_PASS jarvis_db -se"
 TS() { date '+%Y-%m-%d %H:%M:%S'; }
 
 log() { echo "[$(TS)] $1" >> "$LOG"; }

deploy/reactor.env.example

@@ -0,0 +1,7 @@
+# JARVIS Arc Reactor — required secrets. Copy to /etc/jarvis-arc/reactor.env
+# (root:www-data 0640), loaded by systemd EnvironmentFile. Not committed.
+JARVIS_DB_PASS=your-db-password
+CLAUDE_API_KEY=sk-ant-...
+GROQ_API_KEY=gsk_...
+GMAIL_PASS=your-gmail-app-password
+ICLOUD_PASS=your-icloud-app-password

deploy/reactor.py

@@ -39,24 +39,24 @@ VERSION     = "9.0.0"
 DB_HOST     = "localhost"
 DB_PORT     = 3306
 DB_USER     = "jarvis_user"
-DB_PASS     = "J4rv1s_Pr0t0c0l_2026!"
+DB_PASS = os.environ.get("JARVIS_DB_PASS", "")
 DB_NAME     = "jarvis_db"
 LOG_FILE    = "/var/log/jarvis/arc_reactor.log"
 POLL_INTERVAL      = 3
 HEARTBEAT_INTERVAL = 30
 
-CLAUDE_API_KEY = "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"
+CLAUDE_API_KEY = os.environ.get("CLAUDE_API_KEY", "")
 CLAUDE_MODEL   = "claude-sonnet-4-6"
-GROQ_API_KEY   = "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"
+GROQ_API_KEY = os.environ.get("GROQ_API_KEY", "")
 GROQ_MODEL     = "llama-3.3-70b-versatile"
 OLLAMA_HOST    = "http://10.48.200.210:11434"
 OLLAMA_MODEL   = "llama3.1:8b"
 OLLAMA_VISION_MODEL = os.environ.get("OLLAMA_VISION_MODEL", "")  # e.g. "llava" or "moondream" -- empty = disabled
 
 GMAIL_USER  = "myronblair@gmail.com"
-GMAIL_PASS  = "demsvdylwweacbcx"
+GMAIL_PASS = os.environ.get("GMAIL_PASS", "")
 ICLOUD_USER = "myronblair@icloud.com"
-ICLOUD_PASS = "yxfi-yvzu-geqk-japr"
+ICLOUD_PASS = os.environ.get("ICLOUD_PASS", "")
 
 # ── LOGGING ───────────────────────────────────────────────────────────────────
 os.makedirs(os.path.dirname(LOG_FILE), exist_ok=True)

public_html/login.php

@@ -1,6 +1,7 @@
 <?php
 ini_set('session.cache_limiter', '');
 header('Cache-Control: no-store, no-cache, must-revalidate, no-transform');
+require_once __DIR__ . '/../api/config.php';
 session_start();
 if (!empty($_SESSION['jarvis_token'])) { header('Location: /'); exit; }
 $error = '';
@@ -8,8 +9,8 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
     $u = trim($_POST['username'] ?? '');
     $p = $_POST['password'] ?? '';
     if ($u && $p) {
-        $pdo = new PDO('mysql:host=localhost;dbname=jarvis_db;charset=utf8mb4',
-            'jarvis_user', 'J4rv1s_Pr0t0c0l_2026!',
+        $pdo = new PDO('mysql:host=' . DB_HOST . ';dbname=' . DB_NAME . ';charset=utf8mb4',
+            DB_USER, DB_PASS,
             [PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION]);
         $row = $pdo->prepare('SELECT * FROM users WHERE username=? LIMIT 1');
         $row->execute([$u]);