ymrtech/nix-config
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Activity Actions

secrets: rotate the agent's Grafana service-account token #354

Merged
hermes merged 1 commit from task/grafana-token-rot into main 2026-09-17 19:16:44 -06:00
Conversation 0 Commits 1 Files changed 1 +74 -74
hermes commented 2026-09-17 19:14:30 -06:00
Collaborator
Copy link

Rotates the agent's Grafana credential properly: mint new, deploy, verify, then revoke the old.

  • The token belongs to service account sa-1-hermes (id 2, role Editor, the only SA in the org) and was created 2026-08-22; it was in active use (lastUsedAt 19:13 today). A second token (hermes-rotated-2026-09-17, id 2) was minted through the Grafana API on public with the admin credentials from sops, and a direct GET /api/org with it returns 200.
  • Only hermes-env's GRAFANA_TOKEN line changes. No new wiring needed: the fragment already declares restartUnits (hermes-agent + hermes-backend on vpn, the same pair on public since #352).
  • Revocation is deliberately NOT in this PR: the old token stays valid until this deploy is verified on vpn and public, then it is deleted through the API. That ordering means the agent never holds a dead credential during the switch.

Verified pre-push: 1 of 42 top-level keys differs from origin/main, the 9 env key names are unchanged, decrypt round-trips to the intended value, recipients byte-identical.

Note on process: my first attempt at this edit was made in the shared primary checkout, which sits at 5f1c3b2 (#347) while origin/main is e9e2c6d — a sops re-encrypt from there would have resurrected spooty and reverted six already-rotated secrets. Nothing was pushed; the working tree was restored and the change rebuilt from origin/main in a fresh worktree.

Rotates the agent's Grafana credential properly: mint new, deploy, verify, then revoke the old. * The token belongs to service account `sa-1-hermes` (id 2, role Editor, the only SA in the org) and was created 2026-08-22; it was in active use (`lastUsedAt` 19:13 today). A second token (`hermes-rotated-2026-09-17`, id 2) was minted through the Grafana API on public with the admin credentials from sops, and a direct `GET /api/org` with it returns 200. * Only `hermes-env`'s `GRAFANA_TOKEN` line changes. No new wiring needed: the fragment already declares `restartUnits` (`hermes-agent` + `hermes-backend` on vpn, the same pair on public since #352). * **Revocation is deliberately NOT in this PR:** the old token stays valid until this deploy is verified on vpn and public, then it is deleted through the API. That ordering means the agent never holds a dead credential during the switch. Verified pre-push: 1 of 42 top-level keys differs from `origin/main`, the 9 env key names are unchanged, decrypt round-trips to the intended value, recipients byte-identical. Note on process: my first attempt at this edit was made in the shared primary checkout, which sits at `5f1c3b2` (#347) while `origin/main` is `e9e2c6d` — a sops re-encrypt from there would have resurrected `spooty` and reverted six already-rotated secrets. Nothing was pushed; the working tree was restored and the change rebuilt from `origin/main` in a fresh worktree.
secrets: rotate GRAFANA_TOKEN (agent's Grafana service-account token)
All checks were successful
NixOS Build Check / Flake input regression guard (pull_request) Successful in 3s
Details
NixOS Build Check / Scope changed deployable hosts (pull_request) Successful in 4s
Details
NixOS Build Check / Eval giga (scope + liveness + offline fallback) (pull_request) Successful in 3s
Details
PR base guard / Base drift / conflict check (pull_request) Successful in 1s
Details
Secret Scan / gitleaks scan (pull_request) Successful in 5s
Details
NixOS Build Check / Build mail closure (on mail) (pull_request) Successful in 12s
Details
NixOS Build Check / Build vpn closure (on vpn) (pull_request) Successful in 21s
Details
NixOS Build Check / Eval giga natively (authoritative, on giga) (pull_request) Successful in 33s
Details
NixOS Build Check / Build public closure (on public) (pull_request) Successful in 1m14s
Details
b837ff7f7d 
Mints a second token for the existing service account sa-1-hermes (id 2,
Editor) via the Grafana API, lands it in hermes-env's GRAFANA_TOKEN line, and
leaves the old token alive until the deploy is verified — the revoke happens
afterwards from the operator side, so the agent is never left without a working
credential in the same window.

hermes-env already declares restartUnits (hermes-agent + hermes-backend on vpn,
same pair on public since #352), so the change reaches the running processes
without new wiring.

Verified before pushing: exactly 1 of 42 top-level keys differs from origin/main,
the 9 env key names are unchanged, the round-trip decrypts to the intended
value, and recipients are untouched.
hermes merged commit 654eed0688 into main 2026-09-17 19:16:44 -06:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
backlog

   
bug

   
enhancement

   
in-progress

   
review

   
todo
No labels
backlog
bug
enhancement
in-progress
review
todo
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
ymrtech/nix-config!354
No description provided.