jfraeys/infra
Watch
1
0
Fork
You've already forked infra
 0
Code Issues 21 Pull requests 4 Projects Releases Packages Wiki Activity Actions

fix(rotate): forgejo rotates only the metrics token (with Prometheus); headscale deploys with Authelia #163

Merged
jfraeys merged 1 commit from jfraeys/fix/rotate-forgejo-headscale into main 2026-10-14 17:43:26 -04:00
Conversation 0 Commits 1 Files changed 2 +8 -8
jfraeys commented 2026-10-14 17:36:40 -04:00
Owner
Copy link

Found before running wave 1 of the rotation plan (#117): two of its four commands would have broken something.

./infra rotate forgejo generated random values for three keys:

  • FORGEJO_METRICS_TOKEN: real and ours to choose, but Prometheus scrapes Forgejo with it, and the printed deploy named only forgejo, so the scrape would fail until Prometheus was redeployed. Deploy is now --tags forgejo,prometheus.
  • FORGEJO_API_TOKEN: read by nothing in the repo (only the generator creates it). No longer rotated; manifest marks it unused, to delete from the vault.
  • FORGEJO_RUNNER_REGISTRATION_TOKEN: only registers a persistent runner (forgejo-runner register --token); none exists, CI runners are ephemeral and registered via the admin API. A registration token is issued by Forgejo, so a random one would not work. No longer rotated; the manifest says where a real one comes from.

./infra rotate headscale rotated both halves of the OIDC client secret (Headscale's and Authelia's) but printed a deploy of headscale only, leaving Authelia on the old half: Headscale SSO login would break. Deploy is now --tags headscale,authelia.

Expiry report: unknown 32 -> 30. Checked: rendered next steps show the new tags; bash -n; test-rotation-lock, test-bitwarden-save, test-infra-cli; yamllint.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Ge5tovcwdEUBtPwUktsZZZ

Found before running wave 1 of the rotation plan (#117): two of its four commands would have broken something. **`./infra rotate forgejo`** generated random values for three keys: - `FORGEJO_METRICS_TOKEN`: real and ours to choose, but Prometheus scrapes Forgejo with it, and the printed deploy named only `forgejo`, so the scrape would fail until Prometheus was redeployed. Deploy is now `--tags forgejo,prometheus`. - `FORGEJO_API_TOKEN`: read by nothing in the repo (only the generator creates it). No longer rotated; manifest marks it unused, to delete from the vault. - `FORGEJO_RUNNER_REGISTRATION_TOKEN`: only registers a *persistent* runner (`forgejo-runner register --token`); none exists, CI runners are ephemeral and registered via the admin API. A registration token is issued by Forgejo, so a random one would not work. No longer rotated; the manifest says where a real one comes from. **`./infra rotate headscale`** rotated both halves of the OIDC client secret (Headscale's and Authelia's) but printed a deploy of `headscale` only, leaving Authelia on the old half: Headscale SSO login would break. Deploy is now `--tags headscale,authelia`. Expiry report: unknown 32 -> 30. Checked: rendered next steps show the new tags; `bash -n`; test-rotation-lock, test-bitwarden-save, test-infra-cli; yamllint. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01Ge5tovcwdEUBtPwUktsZZZ
fix(rotate): forgejo rotates only the metrics token, deployed with Prometheus; headscale deploys with Authelia
All checks were successful
Lint / lint (pull_request) Successful in 2m25s
Details
Secret scan / scan (pull_request) Successful in 15s
Details
9c42ff8c2d
 
`./infra rotate forgejo` generated random values for three keys:
- FORGEJO_METRICS_TOKEN is real and ours to choose, but Prometheus scrapes
  Forgejo with it and the printed deploy named only `forgejo`: the scrape would
  have failed until Prometheus was redeployed. Tags are now forgejo,prometheus.
- FORGEJO_API_TOKEN is read by nothing. No longer rotated; the manifest marks it
  unused, to delete from the vault.
- FORGEJO_RUNNER_REGISTRATION_TOKEN only registers a persistent runner (none
  exists; CI runners are ephemeral and registered through the admin API), and a
  registration token is issued by Forgejo, so a random value would not work. No
  longer rotated; the manifest says where a real one comes from.
`./infra rotate headscale` rotated both halves of the OIDC client secret but the
printed deploy named only `headscale`, so Authelia would keep the old half and
Headscale's SSO login would break. Tags are now headscale,authelia.

Expiry report: unknown 32 -> 30.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ge5tovcwdEUBtPwUktsZZZ
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
jfraeys/infra!163
No description provided.