docs(runbook): move the env file out of the checkout and add the secret rotation matrix - #82
Merged
Conversation
…et rotation matrix Documents the production env file's new home (~/.config/bottleneck-auth/, loaded through COMPOSE_ENV_FILES), the one-time migration, and why a .env in the checkout should not exist. Replaces the four-line "suspected leaked secret" note with a rotation matrix that names every secret's consumers, its restart set, the blast radius of the gap, and whether an overlap exists, plus step-by-step procedures for the ones that are easy to get wrong: POSTGRES_PASSWORD (alter role over the socket, then --no-deps restarts, and the db recreate that follows), the OIDC key via retired status with no downtime, the bot token, the webhook secret, and the tunnel token. Ends with a triage order for a suspected leak.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Docs-only (deployment guide, on-call runbook, .env.example header, one
README line). Second of the ops tranche.
~/.config/bottleneck-auth/prod.env (0700/0600, PEMs beside it), loaded via
COMPOSE_ENV_FILES exported once in the deploying shell; per-command
--env-file as the fallback. Fails closed without the export. Migration
steps for the existing host; dev-only values go in a separate file.
section: where they live, a rotation matrix (consumers, restart set, blast
radius, overlap) for all ten secrets, procedures for POSTGRES_PASSWORD
(alter role over the socket, --no-deps restarts, the db recreate that a
later full up -d triggers), the OIDC key with no downtime via retired
status (verification and JWKS both include non-revoked keys, checked in
lib/server/config.ts and services/oauth.ts), the bot token, the webhook
secret, and the tunnel token; then a triage order for a suspected leak.
Deviation from the plan: AUTH_SECRETS_DIR is not added to .env.example yet.
Nothing consumes it until the backup sidecar lands (3.5); it will arrive with
that change.
Owner action after merge (no code change involved): perform the move on the
host as documented, then
docker compose config --quiet && docker compose psin a fresh shell.