security: redact credentials and remove corporate hostname/vault references

- README: replace zesticai-non-prod vault name and bigbox hostname with
  generic placeholders; replace hardcoded Tailscale IP with descriptive text
- deploy-to-bigbox.sh: make BIGBOX and TAILSCALE_IP configurable via env
  vars (auto-detect via tailscale ip -4); replace op_zesticai_non_prod.sh
  with op_credentials.sh
- Caddyfile: remove bigbox hostname from comment
- RESEARCH doc: remove hardcoded S3 access key and secret key values from
  the secrets table; replace with generic op:// reference format
- docker-compose_kitchen_sink.yml: replace hardcoded S3 credentials with
  CHANGE_ME placeholders

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

deploy-to-bigbox.sh

@@ -1,21 +1,21 @@
 #!/bin/bash
 #
-# Deploy Gitea Stack to Bigbox with 1Password Secrets Management
+# Deploy Gitea Stack with 1Password Secrets Management
 #
 # Prerequisites:
-#   - SSH access to bigbox configured
-#   - 1Password CLI installed locally and on bigbox
-#   - op_zesticai_non_prod.sh exists on bigbox with valid service account token
+#   - SSH access to target server configured (BIGBOX env var or "your-server" alias)
+#   - 1Password CLI installed locally and on the server
+#   - op_credentials.sh exists on the server (sets OP_SERVICE_ACCOUNT_TOKEN)
 #   - 1Password vault items created (gitea-postgres, gitea-s3)
-#   - Caddy already running on bigbox
+#   - Caddy already running on the server
 #
 # Network Configuration:
 #   - Gitea: Public via Caddy (git.terraphim.cloud) -> localhost:3000
-#   - Prometheus: Tailscale only (100.106.66.7:9000)
-#   - S3: Tailscale only (100.106.66.7:8333)
+#   - Prometheus: Tailscale only (TAILSCALE_IP:9000)
+#   - S3: Tailscale only (TAILSCALE_IP:8333)
 #
 # Usage:
-#   ./deploy-to-bigbox.sh
+#   BIGBOX=your-server TAILSCALE_IP=$(tailscale ip -4) ./deploy-to-bigbox.sh
 #
 
 set -euo pipefail
@@ -27,11 +27,11 @@ YELLOW='\033[1;33m'
 NC='\033[0m' # No Color
 
 # Configuration
-BIGBOX="bigbox"
+BIGBOX="${BIGBOX:-your-server}"
 REMOTE_DIR="~/gitea-stack"
-TAILSCALE_IP="100.106.66.7"
+TAILSCALE_IP="${TAILSCALE_IP:-$(tailscale ip -4 2>/dev/null || echo 'SET_TAILSCALE_IP')}"
 
-echo -e "${GREEN}=== Gitea Stack Deployment to Bigbox ===${NC}"
+echo -e "${GREEN}=== Gitea Stack Deployment to ${BIGBOX} ===${NC}"
 echo ""
 
 # Step 1: Verify local prerequisites
@@ -49,8 +49,8 @@ fi
 echo -e "${GREEN}✓ Local prerequisites verified${NC}"
 echo ""
 
-# Step 2: Verify bigbox prerequisites
-echo -e "${YELLOW}Step 2: Verifying bigbox prerequisites...${NC}"
+# Step 2: Verify server prerequisites
+echo -e "${YELLOW}Step 2: Verifying server prerequisites...${NC}"
 ssh "$BIGBOX" << 'CHECKSCRIPT'
     set -e
 
@@ -73,13 +73,13 @@ ssh "$BIGBOX" << 'CHECKSCRIPT'
     fi
 
     # Check service account script
-    if [ ! -f "$HOME/op_zesticai_non_prod.sh" ]; then
-        echo "Error: op_zesticai_non_prod.sh not found in home directory"
+    if [ ! -f "$HOME/op_credentials.sh" ]; then
+        echo "Error: op_credentials.sh not found in home directory"
         exit 1
     fi
 
     # Test 1Password authentication
-    source "$HOME/op_zesticai_non_prod.sh"
+    source "$HOME/op_credentials.sh"
     if ! op vault list &> /dev/null; then
         echo "Error: 1Password authentication failed"
         exit 1
@@ -100,11 +100,11 @@ ssh "$BIGBOX" << 'CHECKSCRIPT'
     echo "All prerequisites verified"
 CHECKSCRIPT
 
-echo -e "${GREEN}✓ Bigbox prerequisites verified${NC}"
+echo -e "${GREEN}✓ Server prerequisites verified${NC}"
 echo ""
 
 # Step 3: Transfer files
-echo -e "${YELLOW}Step 3: Transferring files to bigbox...${NC}"
+echo -e "${YELLOW}Step 3: Transferring files to ${BIGBOX}...${NC}"
 ssh "$BIGBOX" "mkdir -p $REMOTE_DIR"
 
 rsync -avz --progress \
@@ -130,7 +130,7 @@ ssh "$BIGBOX" << DEPLOYSCRIPT
     cd $REMOTE_DIR
 
     echo "Loading 1Password credentials..."
-    source ~/op_zesticai_non_prod.sh
+    source ~/op_credentials.sh
 
     echo "Injecting secrets into docker-compose.yml..."
     op inject --in-file docker-compose.yml.template --out-file docker-compose.yml
@@ -260,14 +260,14 @@ echo "  - Prometheus:  http://${TAILSCALE_IP}:9000"
 echo "  - S3 API:      http://${TAILSCALE_IP}:8333"
 echo ""
 echo "SSH Access:"
-echo "  - Gitea SSH:   ssh://bigbox:222"
+echo "  - Gitea SSH:   ssh://${BIGBOX}:222"
 echo ""
 echo "Note: Prometheus and S3 are NOT accessible from the public internet."
 echo "      Connect via Tailscale first: tailscale up"
 echo ""
 echo "Next steps:"
-echo "  1. Ensure DNS points git.terraphim.cloud to bigbox"
+echo "  1. Ensure DNS points git.terraphim.cloud to ${BIGBOX}"
 echo "  2. Access Gitea at https://git.terraphim.cloud to complete setup"
 echo "  3. Change default admin password after first login"
-echo "  4. Review Caddy logs: ssh bigbox 'sudo tail -f /var/log/caddy/gitea-access.log'"
+echo "  4. Review Caddy logs: ssh ${BIGBOX} 'sudo tail -f /var/log/caddy/gitea-access.log'"
 echo ""