# Finding Your Connection Details

## Finding your credentials

Go to portal → **Connect**. This page shows connection details for every deployed service, including endpoints, usernames, and passwords.

- Passwords are masked by default — click to reveal.
- Copy buttons next to each field for quick clipboard access.
- Only deployed (enabled) services appear.

## Service endpoints

### Public URLs

Services with a web interface are reachable at `https://<your-slug>-<service>.compacthive.dev`:

| Service | URL pattern |
|---|---|
| Woodpecker CI | `<your-slug>-ci.compacthive.dev` |
| Grafana (part of Monitoring) | `<your-slug>-grafana.compacthive.dev` |
| Forgejo | `<your-slug>-forgejo.compacthive.dev` |
| MinIO Console | `<your-slug>-minio.compacthive.dev` |
| Uptime Kuma | `<your-slug>-status.compacthive.dev` |
| FileBrowser | `<your-slug>-files.compacthive.dev` |
| Custom apps | `<your-slug>-<app-name>.compacthive.dev` |

### Internal-only services

These don't have a public URL — they're only reachable from within your namespace, or via the Headscale VPN add-on (Business tier and up):

| Service | Internal address | Port |
|---|---|---|
| PostgreSQL | `pg-<tenant-id>-rw.<namespace>.svc` | 5432 |
| KeyDB cache | `cache-<tenant-id>.<namespace>.svc` | 6379 |
| MinIO (S3 API) | `minio-<tenant-id>.<namespace>.svc` | 9000 |

## Credential lifecycle

- Credentials are generated once during initial deployment and stored as Kubernetes Secrets.
- They survive service restarts and redeployments.
- They are deleted only when the tenant namespace (or the specific service) is removed.
- There's no self-service rotation UI today — if you need to rotate a service credential, disable and re-enable the service.