Credentials
Secrets are never in the config file. On Linux they are systemd credentials, encrypted at rest with the host key (systemd-creds encrypt) and decrypted only into the service’s private $CREDENTIALS_DIRECTORY while it runs. Without systemd (for development) each one can come from an environment variable instead. A credential file wins over the environment variable; a trailing newline is stripped; an empty value counts as missing.
| Credential | Encrypted file | Environment variable | Required | What it is |
|---|---|---|---|---|
discord_token | /etc/polarbot/discord_token.cred | POLARBOT_DISCORD_TOKEN | yes: the bot does not start without it | The bot token from the Discord Developer Portal (Bot → Reset Token). install.sh asks for it with hidden input. |
discord_client_secret | /etc/polarbot/discord_client_secret.cred | POLARBOT_DISCORD_CLIENT_SECRET | no: without it command visibility sync and the web server are off | The application’s OAuth2 client secret (Developer Portal → OAuth2), used to exchange /perms authorize codes and refresh tokens. |
oauth_key | /etc/polarbot/oauth_key.cred | POLARBOT_OAUTH_KEY | no: same as discord_client_secret (both are needed) | 32 random bytes as 64 hex characters. Subkeys derived from it (HKDF-SHA256) sign the OAuth state (HMAC-SHA256) and encrypt stored refresh tokens (AES-256-GCM). install.sh generates it. A new key invalidates every stored authorization. |
The unit loads them with:
LoadCredentialEncrypted=discord_token:/etc/polarbot/discord_token.cred
LoadCredentialEncrypted=discord_client_secret:/etc/polarbot/discord_client_secret.cred
LoadCredentialEncrypted=oauth_key:/etc/polarbot/oauth_key.cred