jfraeys/infra
Watch
1
0
Fork
You've already forked infra
 0
Code Issues 21 Pull requests 4 Projects Releases Packages Wiki Activity Actions

chore(secrets): rotated Vaultwarden and Authelia secrets (2026-10-13) #125

Merged
jfraeys merged 1 commit from jfraeys/chore/rotated-secrets-2026-10-13 into main 2026-10-13 15:25:05 -04:00
Conversation 0 Commits 1 Files changed 1 +120 -120
jfraeys commented 2026-10-13 15:06:52 -04:00
Owner
Copy link

Re-applies the secrets rotated on the operator machine on 2026-10-13 onto main's vault (encrypted file only; no values appear here).

Keys changed (names only): VAULTWARDEN_ADMIN_TOKEN, VAULTWARDEN_OIDC_CLIENT_SECRET, AUTHELIA_OIDC_VAULTWARDEN_CLIENT_SECRET, AUTHELIA_OIDC_FORGEJO_CLIENT_SECRET, AUTHELIA_OIDC_GRAFANA_CLIENT_SECRET, AUTHELIA_OIDC_HMAC_SECRET, AUTHELIA_SESSION_SECRET, AUTHELIA_IDENTITY_VALIDATION_RESET_PASSWORD_JWT_SECRET.

Not changed: AUTHELIA_OIDC_PRIVATE_KEY_PEM and CI_EPHEMERAL_ANSIBLE_SSH_KEY keep main's values (#52). The PEM was also rotated locally on a checkout that predated #52; main's is the deployed one, so it wins.

Checked: same 108 keys as main; exactly the 8 above differ; each equals the operator-machine rotation.

Not deployed. Merging does not change any running service. Before deploying: the three OIDC client secrets (Vaultwarden, Forgejo, Grafana) must be deployed together with Authelia or SSO logins to that service break; the session/HMAC change logs everyone out. Use the deploy commands rotate-secret.sh printed per service. Does not touch a staging path, so no staging run starts.

🤖 Generated with Claude Code

Re-applies the secrets rotated on the operator machine on 2026-10-13 onto main's vault (encrypted file only; no values appear here). **Keys changed (names only):** VAULTWARDEN_ADMIN_TOKEN, VAULTWARDEN_OIDC_CLIENT_SECRET, AUTHELIA_OIDC_VAULTWARDEN_CLIENT_SECRET, AUTHELIA_OIDC_FORGEJO_CLIENT_SECRET, AUTHELIA_OIDC_GRAFANA_CLIENT_SECRET, AUTHELIA_OIDC_HMAC_SECRET, AUTHELIA_SESSION_SECRET, AUTHELIA_IDENTITY_VALIDATION_RESET_PASSWORD_JWT_SECRET. **Not changed:** AUTHELIA_OIDC_PRIVATE_KEY_PEM and CI_EPHEMERAL_ANSIBLE_SSH_KEY keep main's values (#52). The PEM was also rotated locally on a checkout that predated #52; main's is the deployed one, so it wins. Checked: same 108 keys as main; exactly the 8 above differ; each equals the operator-machine rotation. **Not deployed.** Merging does not change any running service. Before deploying: the three OIDC client secrets (Vaultwarden, Forgejo, Grafana) must be deployed together with Authelia or SSO logins to that service break; the session/HMAC change logs everyone out. Use the deploy commands rotate-secret.sh printed per service. Does not touch a staging path, so no staging run starts. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
chore(secrets): rotated Vaultwarden and Authelia secrets (2026-10-13), re-applied onto main's vault
All checks were successful
Secret scan / scan (pull_request) Successful in 19s
Details
ed9109fd12
 
Applies the 8 keys rotated on the operator machine on top of main (which already holds the #52 rotation of
AUTHELIA_OIDC_PRIVATE_KEY_PEM and CI_EPHEMERAL_ANSIBLE_SSH_KEY); main's PEM is kept, it is the deployed one.
Not deployed yet: Vaultwarden and Authelia need a deploy before these values are live.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
jfraeys/infra!125
No description provided.