-
Notifications
You must be signed in to change notification settings - Fork 0
State and Secrets
BlokeBot keeps its durable data in private application state:
| Store | Contents |
|---|---|
blokebot.db |
Channel data and encrypted custom-bot credentials |
twitch.tokens.json |
The main bot account's reusable OAuth token set |
| ASP.NET Core Data Protection keys | Automatically managed keys used to protect custom-bot credentials |
Only the BlokeBot service identity should be able to read this state. On Windows, Data Protection protects its keys with DPAPI LocalMachine.
Native blokebot serve uses these state directories by default:
| Platform | State directory |
|---|---|
| Linux |
$XDG_STATE_HOME/blokebot, or ~/.local/state/blokebot
|
| macOS | ~/Library/Application Support/BlokeBot |
| Windows | %LOCALAPPDATA%\BlokeBot |
--data-dir PATH chooses a persistent application state directory. An explicit BlokeBot:DatabasePath or TwitchBot:Identity:TokenCachePath can move that individual file, so include every resolved state location in backups. Docker keeps application state under /data; the NixOS service uses /var/lib/blokebot.
Back up the complete application state from a stopped service or one consistent filesystem snapshot. For a live SQLite-only backup, use SQLite's online backup support; copying only blokebot.db while its WAL is active is not a complete database backup.
Keep full-state backups private. They contain the main-bot token cache and the Data Protection keys as well as the database.
Custom-bot encryption is zero-config. BlokeBot creates and persists ASP.NET Core Data Protection keys automatically; operators do not supply key files, identifiers, schedules, or mounts.
A copied SQLite database, WAL, or SQL backup does not by itself expose reusable custom-bot access or refresh tokens. Theft or compromise of the full application state directory or the running host is outside that boundary.
When an upgrade finds old plaintext custom-bot credentials, BlokeBot deletes them, disables the custom bot, and shows the channel owner an alert to reconnect it. The old credentials are not retained or used during the upgrade.
Dashboard sign-in and the normal Connect channel flow do not retain reusable OAuth token sets. The main bot is different: twitch.tokens.json contains its reusable grant and must always be treated as a live credential. See Twitch identity and OAuth.