fix(secrets): rotate exposed CI SSH key and Authelia OIDC key #52

Merged

jfraeys merged 2 commits from jfraeys/fix/p2-rotate-exposed into main

2026-10-13 09:50:48 -04:00

jfraeys commented

2026-10-10 17:39:35 -04:00

Owner

Fresh CI_EPHEMERAL_ANSIBLE_SSH_KEY and AUTHELIA_OIDC_PRIVATE_KEY_PEM in the vault (both were printed in the redaction incident), and regenerate-ci-ephemeral-ssh-key.sh rewritten for SOPS (it still assumed Ansible Vault). Production redeploy (scripts/deploy-services.sh --limit services_hosts) is a separate operator step and also mints a fresh Tailscale authkey. 🤖 Generated with Claude Code

Fresh `CI_EPHEMERAL_ANSIBLE_SSH_KEY` and `AUTHELIA_OIDC_PRIVATE_KEY_PEM` in the vault (both were printed in the redaction incident), and `regenerate-ci-ephemeral-ssh-key.sh` rewritten for SOPS (it still assumed Ansible Vault). Production redeploy (`scripts/deploy-services.sh --limit services_hosts`) is a separate operator step and also mints a fresh Tailscale authkey. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

jfraeys added 1 commit

2026-10-10 17:39:35 -04:00

fix(secrets): rotate exposed CI SSH key and Authelia OIDC key; SOPS-aware key regen script

Lint / lint (pull_request) Successful in 2m2s

Details

Secret scan / scan (pull_request) Successful in 14s

Details

fb21518f45

Both values were printed in full during a redaction incident (docs/incidents.md).
Vault holds fresh keys; production redeploy pending.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

jfraeys added 1 commit

2026-10-13 09:47:21 -04:00

Merge main into p2-rotate-exposed; re-apply the two rotated keys onto main's vault

Lint / lint (pull_request) Successful in 2m12s

Details

Secret scan / scan (pull_request) Successful in 18s

Details

29f95d8e42

Resolved by taking main's secrets/vault.sops.yml and re-applying
AUTHELIA_OIDC_PRIVATE_KEY_PEM and CI_EPHEMERAL_ANSIBLE_SSH_KEY from this branch
(verified: every other key equals main's, same key set). The regenerate script keeps
this branch's rewrite with main's --limit services hint.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

jfraeys merged commit 5c338ba9e8 into main

2026-10-13 09:50:48 -04:00

jfraeys referenced this pull request from a commit

2026-10-13 09:50:55 -04:00

Merge pull request 'fix(secrets): rotate exposed CI SSH key and Authelia OIDC key' (#52) from jfraeys/fix/p2-rotate-exposed into main

jfraeys referenced this pull request

2026-10-13 09:58:18 -04:00

docs(secrets): close P2, record the rotation and the two gitleaks dispositions #95

jfraeys referenced this pull request

2026-10-13 11:28:35 -04:00

feat(secrets): monthly expiry report workflow and the manifest facts the repo knows (P8, 3/3; stacked on #99) #100

jfraeys referenced this pull request