| 2026-07-19 00:00 UTC | V32_REDIS_LOCAL_PASSWORD (secrets/pinbox24-w3.env.sops) — new key, bootstrap + wiring fix | bootstrap/new (#4311 PATH A, user-approved restart window — supersedes staged/conflicted PR #3956) — the local redis-v32 container on bms-1 is ABSENT, so v32-prod was throwing ~1700×/hr EAI_AGAIN redis-v32 DNS-resolution errors. Fix: (1) added a fresh, independently-generated 40-char hex V32_REDIS_LOCAL_PASSWORD (openssl rand -hex 20, matching sops-reset-redis.ps1’s New-RandomHex 20 convention), distinct from the now-disconnected OVH V32_REDIS_PASSWORD (left untouched); (2) fixed secrets-sync.yml’s sync-pinbox24-w3 Python so BOTH the local redis-v32 container’s requirepass (redis-v32-environment.env REDIS_PASSWORD) AND the backend/reso/socket REDIS_PASSWORD override (backend-environment.env) are sourced from V32_REDIS_LOCAL_PASSWORD — matched auth on force-recreate. Registered in docs/sops-templates/pinbox24-w3.keys. Applied as a clean branch off current main (rebased over #3954’s V32_LOGDNA_KEY change) rather than force-pushing the CONFLICTING/DIRTY #3956 branch, which had diverged with unrelated stale edits. Live redis-v32 container recreate is handled by the merge-triggered sync-pinbox24-w3 CI job + sys-admin — NOT touched by this session per task scope. | claude (secret-manager worker, bms-4, infra task #4311) | SOPS secrets/pinbox24-w3.env.sops ✅ canary OK · 37→38 keys · V32_REDIS_LOCAL_PASSWORD present, non-empty, 40-char hex · V32_REDIS_PASSWORD UNCHANGED (sha256 match vs main) · 6/6 age recipients preserved · docs/sops-templates/pinbox24-w3.keys updated ✅ · secrets-sync.yml sync-pinbox24-w3 wires both redis-v32-environment.env + backend-environment.env REDIS_PASSWORD from V32_REDIS_LOCAL_PASSWORD ✅ · distribution + live container recreate: via merge-triggered sync-pinbox24-w3 run (see PR) |
| 2026-07-19 00:00 UTC | 10× W3 source keys (secrets/pinbox24-w3.env.sops) — V32_MAILGUN_USER_NAME, V32_twilioAccountSid, V32_twilioAuthToken, V32_twilioFromNumber, V32_onesignal_USER_AUTH_KEY, V32_onesignal_APP_AUTH_KEY, V32_onesignal_APP_ID, V32_jabber_JID, V32_jabber_PASSWORD, V32_jabber_HOST | capture (#4286, SOPS-sourcing gate — supersedes #2855) — moved the W3 credential literals out of p24-v-3.2/docker-deploy-prod.sh into SOPS so the deploy script can ${VAR}-source them (step 2, sys-admin). Values captured verbatim = zero behaviour change (no rotation). Extracted from the literal assignment lines (L26/L81–96) of the deploy script on bms-1 — NOT the consuming key=$key REF lines (L135–155) that the rejected PR #4287 mistakenly captured (all placeholders $name). Added a value-shape guard to the pre-encrypt canary rejecting any value matching ^\$[A-Za-z_]; shapes cross-checked (Twilio SID AC+32 = 34ch, OneSignal APP_ID 36-char UUID, MAILGUN_USER_NAME=api per Mailgun HTTP-API basic-auth). No value ever printed. | claude (secret-manager worker, bms-4, queue row 3056) | SOPS secrets/pinbox24-w3.env.sops ✅ canary OK · 27→37 keys · 6/6 age recipients preserved · value-shape guard passed (0 placeholders) · distribution via existing sync-pinbox24-w3 generic V32_-strip pass (fires on merge) · PR → main (see issue #4286) · W4 blockers (V42_S3_DB_URI separate-DB value, 14 unenumerated W4 literals incl. PAYU/przelewy24) still need human decision — see issue comment |