Credentials & Break-Glass
:::danger CONFIDENTIAL — restricted access
This page lists every administrative and service credential for the golemsec lab. These are lab/demo credentials for a private, non-internet-exposed environment — they are documented here deliberately so the operator can recover access. Do not reuse these passwords anywhere outside the golemsec lab.
:::
Cloud / infrastructure
| Scope | Identity | Secret / Access |
|---|
AWS account 517798688500 | IAM user grimmjow | local CLI profile binary |
| pfSense edge (SSH) | ec2-user | key file D:\golemsec\golemsec-key.pem |
| pfSense EIP | — | 35.170.40.167 |
| Operator access | — | VPN + AWS SSM Session Manager (no public ingress) |
| Cloudflare | account Ron.b@iontwrks.com's Account | zone golemsec.io (token stored outside this doc) |
Active Directory / Windows
| Account | Username | Password |
|---|
| Domain Administrator (break-glass) | GOLEMSEC\Administrator | G0lemSecAdmin#2026 |
| DSRM (Directory Services Restore Mode) | — | G0lemSecDSRM#2026 |
| All 200 employees (default) | firstname.lastname | G0lemSecUser#2026 |
| Exchange admin | GOLEMSEC\Administrator | G0lemSecAdmin#2026 |
Identity / SSO
| System | Username | Password |
|---|
| Keycloak master admin | admin | G0lemSecKC2026 |
| Keycloak URL | — | http://10.50.20.133:8080 (realm golemsec) |
OIDC client secrets (realm golemsec)
| Client ID | Secret |
|---|
grafana | G0lemSecGrafana#2026 |
gitlab | G0lemSecGitLab#2026 |
nextcloud | G0lemSecNextcloud#2026 |
glpi | G0lemSecGLPI#2026 |
Databases
| Engine | Host | Account | Password |
|---|
| SQL Server 2022 | 10.50.30.38:1433 | sa | G0lemSecSQL#2026 |
| MySQL (native, db-pgmy) | 10.50.30.12:3306 | root (socket) | root (local only) |
| MySQL — GLPI | 10.50.30.12 | glpi | G0lemSecGLPI#2026 |
| MySQL — Akaunting | 10.50.30.12 | akaunting | Akng2026 |
| MySQL — OrangeHRM | 10.50.30.12 | orangehrm | G0lemSecOHRM#2026 |
PostgreSQL — golemsec_corp (PII) | 10.50.30.12:5432 | (per-app) | see provisioning |
SIEM / monitoring
| System | URL | Account | Password |
|---|
| Wazuh indexer / dashboard (admin) | https://10.50.40.63 | admin | UPSlE69U.dwIKD06rKxy68b2EaPW4*4b |
| Wazuh — AD login | — | firstname.lastname (AD, must be in GG-IT/GG-Executive for admin) | G0lemSecUser#2026 |
| Zabbix (super admin) | http://10.50.50.213 | Admin | zabbix |
Applications
| App | URL | Username | Password |
|---|
| Nextcloud (local admin) | http://10.50.10.51 | admin | G0lemSecNC#2026 |
| Akaunting (local admin) | http://10.50.20.38:8084/auth/login | admin@golemsec.io | G0lemSecAk#2026 |
| OrangeHRM (local admin) | http://10.50.20.38:8082 | Admin | G0lemSecHR#2026 |
| GLPI (local super-admin) | http://10.50.20.38 | glpi | glpi |
| Grafana / GitLab / Nextcloud / ERPNext / Zabbix / GLPI / Jenkins / SuiteCRM | — | via golemsec SSO / AD | (AD password) |
Most apps: employees sign in with their AD credentials (firstname.lastname / G0lemSecUser#2026). Akaunting + OrangeHRM run on standalone local auth (Akaunting LDAP is a paid module; OrangeHRM LDAP is a pending UI step).
OIDC client secrets — additional
Keycloak realm golemsec also has realm roles admin (→ Grafana Admin) and editor (→ Grafana Editor), assigned to IT/NOC and dev/exec staff respectively.
Email relay
- Outbound mail relays via Amazon SES (AWS blocks port 25).
golemsec.io is SES-verified (DKIM + _amazonses TXT in Cloudflare). SES is in sandbox (200/day) — external recipients must be verified first.
Rotation note
When golemsec graduates from "lab" to a longer-lived asset, rotate every secret above, move Keycloak off start-dev/H2, and store secrets in a vault rather than this page.