secrets: rotate dashboard session token + auth signing secret #352
No reviewers
Labels
No labels
backlog
bug
enhancement
in-progress
review
todo
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
ymrtech/nix-config!352
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "task/dash-cred-rot"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Rotates the two dashboard credentials the operator generates itself. Deliberately not rotated:
dashboard.basic_auth's scryptpassword_hash— it encodes a human login, and the new plaintext would need an out-of-band handoff, so it stays until the owner asks for it.hermes-dashboard-token— same 64-char shape. The backend's launch wrapper (hermes-backend-launch) reads/run/secrets/hermes-dashboard-token, exports it asHERMES_DASHBOARD_SESSION_TOKEN, and deliberately never puts it on a command line — so a rotated token reaches the running server only through a restart.restartUnits = [ "hermes-backend.service" ]declared on both declaring hosts (vpn: ownerhermes; public: ownerhermes-bot).hermes-env'sHERMES_DASHBOARD_BASIC_AUTH_SECRET— 43-char urlsafe, read once at start byhermes-backend. public'shermes-envgains the samerestartUnitspair vpn's already carries (vpn's came with #351).Verification: round-trip asserts before the move (new values exact,
password_hashline unchanged, only 2 of 43 top-level keys differ, recipients byte-identical). Post-deploy: the rendered secrets on each host contain the new values and none of the old, the password hash line is byte-identical to before,hermes-backendrestarted on vpn and public, and the running process'sHERMES_DASHBOARD_SESSION_TOKEN(via/proc/<pid>/environ) hashes to the new token — the value actually in effect, not just the value on disk.Impact: clients that present the old session token (desktop/phone) need to re-pair; the dashboard password is unchanged, so basic-auth logins keep working.
Rotates the two dashboard credentials the operator generates itself, leaving dashboard.basic_auth's scrypt password_hash untouched on purpose (that one is a human login: rotating it would need an out-of-band handoff of the new plaintext). The session token and the HMAC signing secret are machine credentials, so they rotate silently. - hermes-dashboard-token (64 chars, same shape as before): the launch wrapper copies it out of the file into HERMES_DASHBOARD_SESSION_TOKEN at process start and never puts it on a command line, so the running server keeps the old value until it restarts. Declare restartUnits = hermes-backend.service on vpn and public, which is the only path a rotation has into the server. - hermes-env's HERMES_DASHBOARD_BASIC_AUTH_SECRET (43-char urlsafe): read once at start by hermes-backend, so public's hermes-env gains the same restartUnits pair vpn already carries. All three changed keys verified byte-identical round-trip before the move; 2 of 43 top-level keys differ, the password_hash and every recipient are untouched. Clients that present the old session token must re-pair.