Secrets expiry report 2026-10 #112
Loading…
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Secrets expiry report, 2026-10-13
Generated from
secrets/secrets-manifest.yml; no secret value was read.UNKNOWN (neither expired nor known safe) (48)
ALERTMANAGER_DISCORD_WEBHOOK_URL: rotation date not recorded (schedule: every 180d)ALERTMANAGER_SLACK_WEBHOOK_URL: rotation date not recorded (schedule: every 180d)AUTHELIA_IDENTITY_VALIDATION_RESET_PASSWORD_JWT_SECRET: rotation date not recorded (schedule: every 90d)AUTHELIA_LDAP_SERVICE_PASSWORD: no expiry and no rotation schedule recordedAUTHELIA_OIDC_FORGEJO_CLIENT_SECRET: rotation date not recorded (schedule: every 90d)AUTHELIA_OIDC_GRAFANA_CLIENT_SECRET: rotation date not recorded (schedule: every 90d)AUTHELIA_OIDC_HEADSCALE_CLIENT_SECRET: rotation date not recorded (schedule: every 90d)AUTHELIA_OIDC_HMAC_SECRET: rotation date not recorded (schedule: every 90d)AUTHELIA_OIDC_PRIVATE_KEY_PEM: rotated 2026-10-10; no expiry and no rotation schedule recordedAUTHELIA_SESSION_SECRET: rotation date not recorded (schedule: every 90d)AUTHELIA_SMTP_PASSWORD: rotation date not recorded (schedule: every 180d)AUTHELIA_SMTP_USERNAME: rotation date not recorded (schedule: every 180d)AUTHELIA_STORAGE_ENCRYPTION_KEY: no expiry and no rotation schedule recordedBACKUP_HEARTBEAT_URL: no expiry and no rotation schedule recordedBACKUP_RESTORE_TEST_HEARTBEAT_URL: no expiry and no rotation schedule recordedBACKUP_VERIFY_HEARTBEAT_URL: no expiry and no rotation schedule recordedCI_EPHEMERAL_ANSIBLE_SSH_KEY: rotated 2026-10-10; no expiry and no rotation schedule recordedCI_EPHEMERAL_FORGEJO_REPO_TOKEN: rotation date not recorded (schedule: every 90d)CI_EPHEMERAL_WAKEUP_SECRET: rotation date not recorded (schedule: every 90d)FORGEJO_ADMIN_TOKEN: rotation date not recorded (schedule: every 90d)FORGEJO_API_TOKEN: rotation date not recorded (schedule: every 90d)FORGEJO_METRICS_TOKEN: rotation date not recorded (schedule: every 90d)FORGEJO_RUNNER_APP_SKELETON_DEPLOY_KEY: no expiry and no rotation schedule recordedFORGEJO_RUNNER_REGISTRATION_TOKEN: rotation date not recorded (schedule: every 90d)GRAFANA_ADMIN_PASSWORD: rotation date not recorded (schedule: every 90d)HEADSCALE_OIDC_CLIENT_SECRET: rotation date not recorded (schedule: every 90d)LLDAP_ADMIN_PASSWORD: rotation date not recorded (schedule: every 90d)LLDAP_JWT_SECRET: rotation date not recorded (schedule: every 90d)LLDAP_KEY_SEED: rotation date not recorded (schedule: every 90d)OS_PASSWORD: no expiry and no rotation schedule recordedOVH_APPLICATION_SECRET: no expiry and no rotation schedule recordedOVH_OBJECT_STORAGE_ACCESS_KEY_ID: rotated 2026-09-23; no expiry and no rotation schedule recordedPOSTFIX_SENDER_ALERTS_APIKEY: no expiry and no rotation schedule recordedPOSTFIX_SENDER_BOOKING_APIKEY: no expiry and no rotation schedule recordedPOSTFIX_SENDER_CONTACT_APIKEY: no expiry and no rotation schedule recordedPOSTFIX_SENDER_NOREPLY_APIKEY: no expiry and no rotation schedule recordedPOSTGRES_PASSWORD: no expiry and no rotation schedule recordedREBOOT_ALERT_HEARTBEAT_URL: no expiry and no rotation schedule recordedRESTIC_PASSWORD: rotated 2026-09-13; no expiry and no rotation schedule recordedRESTIC_SECONDARY_REPOSITORY: rotated 2026-09-23; no expiry and no rotation schedule recordedSTAGING_SOPS_AGE_KEY: rotation date not recorded (schedule: every 365d)TF_VAR_cloudflare_api_token: no expiry and no rotation schedule recordedTF_VAR_desec_api_token: no expiry and no rotation schedule recordedTF_VAR_linode_token: no expiry and no rotation schedule recordedTF_VAR_root_pass: no expiry and no rotation schedule recordedTF_VAR_user_password: no expiry and no rotation schedule recordedVAULT_DEPLOY_TOKEN: no expiry and no rotation schedule recordedZEDMAIL_API_KEY: no expiry and no rotation schedule recordedFix by recording
expiry,rotate_every_daysandrotated_atin the manifest when the provider's real values are known.Next steps for this report, now tracked:
AUTHELIA_OIDC_PRIVATE_KEY_PEMdate mismatch: manifest says 2026-10-10, remediation register says 2026-10-13): #117CI_EPHEMERAL_TAILSCALE_AUTHKEYexpires 2026-10-20; re-runscripts/deploy-services.shbefore then: #116This issue's body is regenerated by the monthly workflow; keep follow-ups in the issues above.