p24-infra Docs

secrets-rotation-log

3 min read

Secrets Rotation Log

Every rotation appends a row. Newest first.

DateSecretReasonRotatorConfirmed in sync
2026-06-17GRAFANA_ADMIN_PASSWORDLLM session exposure 2026-06-17 — BusyBox wget echoed password in error output during dashboard screenshot session; appeared in Claude transcriptclaudeyes — Infisical CE + GH Secret + Grafana API live update; login verified
2026-06-13P24_INFRA_WASABI_ACCESS_KEYkey QPFW4QRI2A6JUFFKR2PD existed in Wasabi IAM but gave InvalidAccessKeyId on S3 eu-central-2; rotated via Wasabi IAM APIclaudeyes
2026-06-13P24_INFRA_WASABI_SECRET_KEYrotated together with access key aboveclaudeyes
2026-06-13SUPABASE_DB_PASSWORDstale password detected during VACUUM FULL maintenance sessionradieuyes
2026-06-12P24_INFRA_WASABI_ACCESS_KEYkey lost — backup-exporter 65+ errorsradieuyes
2026-06-12P24_INFRA_WASABI_SECRET_KEYkey lost — backup-exporter 65+ errorsradieuyes
2026-05-13SUPABASE_GRAFANA_PASSWORDbootstrapradieun/a
2026-05-13WASABI_ACCESS_KEY_ECOTRANS_MONITORINGbootstrapradieun/a
2026-05-13WASABI_SECRET_KEY_ECOTRANS_MONITORINGbootstrapradieun/a
2026-05-13WASABI_ACCESS_KEY_P24_INFRAbootstrapradieun/a
2026-05-13WASABI_SECRET_KEY_P24_INFRAbootstrapradieun/a
2026-05-13CLOUDFLARE_TOKEN_ZINTEGROWANAbootstrapradieun/a
2026-05-13GRAFANA_ADMIN_PASSWORDbootstrapradieun/a
2026-05-13MYSQL_PASSWORDbootstrapradieun/a
2026-05-13SMTP_USERbootstrapradieun/a
2026-05-13SMTP_PASSWORDbootstrapradieun/a
2026-05-13EMAIL_SENDER_API_KEYbootstrapradieun/a
2026-05-13WAHA_API_KEYbootstrapradieun/a
2026-05-13HSTGR_N8N_API_KEYbootstrapradieun/a
2026-05-13HSTGR_N8N_MCP_TOKENbootstrapradieun/a
2026-05-13ATRAX_AUTH_STRINGbootstrapradieun/a
2026-05-13OPENAI_MONITORING_TOKENbootstrapradieun/a
2026-05-13TRELLO_API_KEYbootstrapradieun/a
2026-05-13TRELLO_TOKENbootstrapradieun/a
2026-05-13DISCORD_WEBHOOK_URLbootstrapradieun/a
2026-05-13P24_DISCORD_INFRA_SCRIPTS_ERRORS_WEBHOOK_URLbootstrapradieun/a
2026-05-13SSH_KEY_ROOTbootstrapradieun/a
2026-05-13SSH_KEY_CLAUDE_ADMINbootstrapradieun/a
2026-05-13VPS1_HOSTINGER_ROOT_PASSWORDbootstrapradieun/a
2026-05-08SUPABASE_SERVICE_ROLE_KEYLLM session exposure 2026-05-06radieuyes
2026-05-08SUPABASE_ACCESS_TOKENLLM session exposure 2026-05-06radieuyes
2026-05-08SENTRY_AUTH_TOKENLLM session exposure 2026-05-06radieuyes
2026-05-08VERCEL_TOKENLLM session exposure 2026-05-06radieuyes
2026-05-08GITHUB_PATLLM session exposure 2026-05-06radieuyes
2026-05-08ANTHROPIC_API_KEYLLM session exposure 2026-05-06radieuyes

2026-06-13 — SUPABASE_DB_PASSWORD rotation

  • Credential: SUPABASE_DB_PASSWORD — postgres superuser password for Supabase project mwkqmgadqnkkihjdeqsi
  • Trigger: stale password detected during a VACUUM FULL maintenance session; rotation was overdue (previous rotation: 2026-05-08)
  • API method: PATCH https://api.supabase.com/v1/projects/mwkqmgadqnkkihjdeqsi/database/password with Authorization: Bearer SUPABASE_ACCESS_TOKEN (discovered that PUT and POST return 404 — PATCH is the correct verb)
  • Updated in:
    • Local workstation: d:\code_2026\p24-infra\.env.local — SUPABASE_DB_PASSWORD
    • GitHub Secret: SUPABASE_DB_PASSWORD
  • NOT updated (not needed):
    • vps-i1 monitoring/.env — Grafana uses the separate grafana_readonly role (SUPABASE_GRAFANA_PASSWORD); db-maintenance.py runs via GitHub Actions and reads SUPABASE_DB_PASSWORD from GH Secrets directly
  • Next rotation due: 2026-09-13 (90 days)

2026-06-12 — Wasabi p24-infra IAM key rotation

  • User: p24-infra (arn:aws:iam::100000049371:user/p24-infra)
  • Bucket: p24-infra (region: eu-central-2, endpoint: s3.eu-central-2.wasabisys.com)
  • Keys deleted: RIEWOBR6... (previous active key, lost/deleted from console), FE6Q...3OHO (stale), 0BSP...XSHA (stale) — all three were invalid at time of discovery
  • New key: QPFW...R2PD (access key ID prefix only; full key in .env.local)
  • Updated in:
    • GitHub Secrets: P24_INFRA_WASABI_ACCESS_KEY, P24_INFRA_WASABI_SECRET_KEY
    • VPS vps-i1: /opt/p24-infra/monitoring/.env
    • Local workstation: d:\code_2026\p24-infra\.env.local
  • Root cause: Previous key RIEWOBR6... was deleted from the Wasabi console without updating any of the consumers. The backup-exporter container was additionally misconfigured — it pointed at bucket ecotrans-monitoring (eu-central-1) using the general WASABI_ACCESS_KEY env var instead of the correct bucket p24-infra (eu-central-2) with P24_INFRA_WASABI_ACCESS_KEY. This resulted in 65+ consecutive errors.
  • Related fix: PR #440 — corrected bucket name (p24-infra), region (eu-central-2), and env var (P24_INFRA_WASABI_ACCESS_KEY) in monitoring/docker-compose.yml for the backup-exporter service.
  • Next rotation due: 2026-09-12 (90 days — shortened from 180d due to this incident)

Conventions

  • Date — UTC, ISO YYYY-MM-DD.
  • Secret — uppercase env-var-style name (e.g. GRAFANA_ADMIN_PASSWORD).
  • Reason — one of: scheduled, compromise, incident, hygiene, bootstrap, LLM session, free text.
  • Rotator — handle of the human who pushed the rotation commit.
  • Confirmed in sync — yes/no/n/a once the secrets-sync workflow has run green and the VPS has the new value live.

Append, never edit. If a row was wrong, append a correction row below it.

Graph View

Backlinks