jfraeys/infra
Watch
1
0
Fork
You've already forked infra
 0
Code Issues 21 Pull requests 4 Projects Releases Packages Wiki Activity Actions

docs(secrets): close P2, record the rotation and the two gitleaks dispositions #95

Merged
jfraeys merged 1 commit from jfraeys/docs/close-p2-r-register into main 2026-10-13 10:59:04 -04:00
Conversation 0 Commits 1 Files changed 2 +9 -8
jfraeys commented 2026-10-13 09:58:18 -04:00
Owner
Copy link

Register and gate updates for facts that are now verified:

  • AUTHELIA_OIDC_PRIVATE_KEY_PEM and CI_EPHEMERAL_ANSIBLE_SSH_KEY: rotated (#52, merged 2026-10-13).
  • CI_EPHEMERAL_TAILSCALE_AUTHKEY: the 2026-10-15 expiry in the register was stale. Read from the host on 2026-10-13: expires 2026-10-20, refreshed by each deploy-services.sh run; alerts exist.
  • Historic staging-web.yml key (42033c6): ssh-keygen cannot load it and it equals no current vault value (exact body compare against the vault before and after #52; an earlier prefix compare was wrong because every OpenSSH key shares the same first 60 base64 characters). No action; I could not derive a fingerprint, so I did not check Forgejo deploy keys and say so in the register.
  • .env.example at 131451e: the value on the flagged line is empty, a false positive.
  • P2 gate: Met (staging-validate green end to end under SOPS, task 577). The acceptance checklist item for a real staging deployment is ticked.
  • R stays open only for operator-machine items (Trash, shell history, transcripts).

Values were never printed: comparisons ran in a script that reports names and match/no-match.

🤖 Generated with Claude Code

Register and gate updates for facts that are now verified: - AUTHELIA_OIDC_PRIVATE_KEY_PEM and CI_EPHEMERAL_ANSIBLE_SSH_KEY: rotated (#52, merged 2026-10-13). - CI_EPHEMERAL_TAILSCALE_AUTHKEY: the 2026-10-15 expiry in the register was stale. Read from the host on 2026-10-13: expires 2026-10-20, refreshed by each deploy-services.sh run; alerts exist. - Historic staging-web.yml key (42033c6): ssh-keygen cannot load it and it equals no current vault value (exact body compare against the vault before and after #52; an earlier prefix compare was wrong because every OpenSSH key shares the same first 60 base64 characters). No action; I could not derive a fingerprint, so I did not check Forgejo deploy keys and say so in the register. - .env.example at 131451e: the value on the flagged line is empty, a false positive. - P2 gate: Met (staging-validate green end to end under SOPS, task 577). The acceptance checklist item for a real staging deployment is ticked. - R stays open only for operator-machine items (Trash, shell history, transcripts). Values were never printed: comparisons ran in a script that reports names and match/no-match. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
docs(secrets): close P2, record the rotation and the two gitleaks dispositions
All checks were successful
Secret scan / scan (pull_request) Successful in 16s
Details
6d71386307
 
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
jfraeys/infra!95
No description provided.