chore(secrets): rotated vaultwarden (admin token, OIDC client secret) #150

Merged

jfraeys merged 1 commit from chore/rotate-vaultwarden-2026-10-14 into main

2026-10-14 12:45:11 -04:00

jfraeys commented

2026-10-14 12:32:41 -04:00

Owner

Re-applies the result of rotate-secret.sh vaultwarden (run on the operator machine, 2026-10-14) onto main's vault. Encrypted file only; no values appear here.

Keys: per the script it rotates VAULTWARDEN_ADMIN_TOKEN, VAULTWARDEN_OIDC_CLIENT_SECRET and, in sync, AUTHELIA_OIDC_VAULTWARDEN_CLIENT_SECRET. Which values actually changed was not independently decrypted for this PR (sops re-encrypts every value on save, so ciphertext differs for all 109 keys). Checked from structure only: the key set is unchanged (109 keys, none added or removed) and the file is structurally encrypted (110 ENC[...] values + sops metadata).

Not deployed. Merging does not change any running service (the running Vaultwarden still has the previous admin token). Before deploying: the OIDC client secret for Vaultwarden and Authelia must go out together or Vaultwarden SSO logins break: ./infra deploy --tags vaultwarden,authelia --limit services. Does not touch a staged path, so no staging run starts.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Ge5tovcwdEUBtPwUktsZZZ

Re-applies the result of `rotate-secret.sh vaultwarden` (run on the operator machine, 2026-10-14) onto main's vault. **Encrypted file only; no values appear here.** **Keys:** per the script it rotates `VAULTWARDEN_ADMIN_TOKEN`, `VAULTWARDEN_OIDC_CLIENT_SECRET` and, in sync, `AUTHELIA_OIDC_VAULTWARDEN_CLIENT_SECRET`. Which values actually changed was **not** independently decrypted for this PR (sops re-encrypts every value on save, so ciphertext differs for all 109 keys). Checked from structure only: the key set is unchanged (109 keys, none added or removed) and the file is structurally encrypted (110 `ENC[...]` values + sops metadata). **Not deployed.** Merging does not change any running service (the running Vaultwarden still has the previous admin token). Before deploying: the OIDC client secret for Vaultwarden and Authelia must go out together or Vaultwarden SSO logins break: `./infra deploy --tags vaultwarden,authelia --limit services`. Does not touch a staged path, so no staging run starts. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01Ge5tovcwdEUBtPwUktsZZZ

jfraeys added 1 commit

2026-10-14 12:32:41 -04:00

chore(secrets): rotated vaultwarden (admin token, OIDC client secret)

Secret scan / scan (pull_request) Successful in 16s

Details

237d6fabfc

Result of `rotate-secret.sh vaultwarden` run on the operator machine on 2026-10-14
(encrypted file only; no values appear here). Per that script it rotates
VAULTWARDEN_ADMIN_TOKEN, VAULTWARDEN_OIDC_CLIENT_SECRET and, in sync with it,
AUTHELIA_OIDC_VAULTWARDEN_CLIENT_SECRET; which values changed was not
independently decrypted for this commit. The key set is unchanged (109 keys, none
added or removed).

Not deployed: merging changes no running service. The three secrets must be deployed
together (`./infra deploy --tags vaultwarden,authelia --limit services`) or Vaultwarden
SSO logins break.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ge5tovcwdEUBtPwUktsZZZ

jfraeys merged commit 6b393493ca into main

2026-10-14 12:45:11 -04:00

jfraeys referenced this pull request from a commit

2026-10-14 12:45:13 -04:00

Merge pull request 'chore(secrets): rotated vaultwarden (admin token, OIDC client secret)' (#150) from chore/rotate-vaultwarden-2026-10-14 into main

jfraeys referenced this pull request

2026-10-14 16:08:04 -04:00

Next: immediate steps (merge, deploy, verify) after the 2026-10-13 session #116