konairius/homelab
10
0
Fork 0
Code Issues 10 Pull Requests 2 Packages Projects Releases 1 Wiki Activity

[security][medium] Plaintext credentials committed in ansible role defaults #198

New Issue
Closed
opened 2026-07-14 09:47:50 +00:00 by claude-bot · 4 comments
claude-bot commented 2026-07-14 09:47:50 +00:00
Member
Copy Link
Copy Source

Finding

Real-looking secrets sit unvaulted in role defaults:

  • ansible/roles/grafana-observability/defaults/main.yml:16 influxdb_token (target host grafana.srv.renner.uno IS in inventory = likely live)
  • ansible/roles/immich/defaults/main.yml:12,18 immich_db_password + immich_oauth_client_secret (target host immich.srv.renner.uno is NOT in inventory -> LEGACY/decommissioned; stale secret, superseded by in-cluster immich sourced from OpenBao)
  • ansible/roles/postgres-simple-ha/defaults/main.yml:7 keepalived_password 'supersecretvrrp'; keepalived-ntp:7 'ntp-ha-2026'; keepalived-vip:7 'dns-ha-2025'

Verified

Values present at the cited lines; immich host absent from inventory (legacy); grafana host present (live).

Impact / Fix

Rotate the influxdb token and move to vault; remove the legacy immich role defaults (or vault them if the role is ever revived); move keepalived secrets to vault (VRRP auth is weak regardless).

Note

The prior review over-stated the immich values as 'live' — corrected here: that role targets a decommissioned host.

Automated security review 2026-07-14. Liveness checked per-item.

## Finding Real-looking secrets sit unvaulted in role defaults: - ansible/roles/grafana-observability/defaults/main.yml:16 influxdb_token (target host grafana.srv.renner.uno IS in inventory = likely live) - ansible/roles/immich/defaults/main.yml:12,18 immich_db_password + immich_oauth_client_secret (target host immich.srv.renner.uno is NOT in inventory -> LEGACY/decommissioned; stale secret, superseded by in-cluster immich sourced from OpenBao) - ansible/roles/postgres-simple-ha/defaults/main.yml:7 keepalived_password 'supersecretvrrp'; keepalived-ntp:7 'ntp-ha-2026'; keepalived-vip:7 'dns-ha-2025' ## Verified Values present at the cited lines; immich host absent from inventory (legacy); grafana host present (live). ## Impact / Fix Rotate the influxdb token and move to vault; remove the legacy immich role defaults (or vault them if the role is ever revived); move keepalived secrets to vault (VRRP auth is weak regardless). ## Note The prior review over-stated the immich values as 'live' — corrected here: that role targets a decommissioned host. --- _Automated security review 2026-07-14. Liveness checked per-item._
claude-bot commented 2026-07-14 10:14:03 +00:00
Author
Member
Copy Link
Copy Source

Verified all three findings against origin/master (local checkout was stale, per instructions). Corrections to my own prior review:

  • grafana-observability, keepalived-ntp, keepalived-vip, postgres-simple-ha ARE live: their target inventory groups/hosts (grafana.srv.renner.uno, pve_cluster, proxmox_dns_ha, authentik_db) all exist in ansible/inventory/pve_hosts.yml, and I found no group_vars/host_vars vault override for any of influxdb_token, keepalived_ntp_auth_pass, keepalived_auth_pass, or keepalived_password -- so the committed plaintext defaults are the actual deployed credentials.
  • immich confirmed legacy: ansible/plays/install-immich.yml targets group proxmox_immich, which does not exist anywhere in ansible/inventory. Immich now runs in-cluster (kubernetes/apps/immich/externalsecret.yaml sources secrets from OpenBao via ExternalSecret).

Opened PR #225 (fix/issue-198): swaps all five plaintext values for changeMeInVault placeholders, matching the convention already used for authentik_db_password/replication_password in the same postgres-simple-ha file, and adds a note to the immich role documenting it's superseded by the in-cluster deployment.

What the PR does NOT do, and needs an operator decision/action on:

  1. Rotate the actual live credentials at their source: the InfluxDB token (in InfluxDB itself) and the keepalived VRRP auth strings for pve_cluster and proxmox_dns_ha. Changing the auth string requires a coordinated rollout across HA peer nodes (all peers must agree, else VRRP breaks) -- I don't have safe access to do that unattended.
  2. Set the real values via ansible-vault. I have no ansible-vault password for this repo, so I can't create/update encrypted group_vars/host_vars with the new secrets myself. Until that's done, rerunning configure-grafana-observability.yml / install-ntp-ha.yml / install-proxmox-dns-ha.yml / install-authentik-ha.yml will push the literal string "changeMeInVault" as the live credential -- please don't rerun those playbooks until vault overrides are in place.
  3. Git history still contains the old plaintext secrets. Rotating the live credentials (item 1) is what actually neutralizes the exposure; scrubbing history is optional cleanup on top of that and I'm not doing it without explicit sign-off (it rewrites history for everyone with a clone).

Proposal: rotate InfluxDB token + both keepalived auth strings, store the new values in group_vars/host_vars via ansible-vault, then merge #225. Let me know if you want anything else done here (e.g. deleting the immich role entirely instead of just placeholder-ing its secrets).

Verified all three findings against origin/master (local checkout was stale, per instructions). Corrections to my own prior review: - grafana-observability, keepalived-ntp, keepalived-vip, postgres-simple-ha ARE live: their target inventory groups/hosts (grafana.srv.renner.uno, pve_cluster, proxmox_dns_ha, authentik_db) all exist in ansible/inventory/pve_hosts.yml, and I found no group_vars/host_vars vault override for any of influxdb_token, keepalived_ntp_auth_pass, keepalived_auth_pass, or keepalived_password -- so the committed plaintext defaults are the actual deployed credentials. - immich confirmed legacy: ansible/plays/install-immich.yml targets group proxmox_immich, which does not exist anywhere in ansible/inventory. Immich now runs in-cluster (kubernetes/apps/immich/externalsecret.yaml sources secrets from OpenBao via ExternalSecret). Opened PR #225 (fix/issue-198): swaps all five plaintext values for changeMeInVault placeholders, matching the convention already used for authentik_db_password/replication_password in the same postgres-simple-ha file, and adds a note to the immich role documenting it's superseded by the in-cluster deployment. What the PR does NOT do, and needs an operator decision/action on: 1. Rotate the actual live credentials at their source: the InfluxDB token (in InfluxDB itself) and the keepalived VRRP auth strings for pve_cluster and proxmox_dns_ha. Changing the auth string requires a coordinated rollout across HA peer nodes (all peers must agree, else VRRP breaks) -- I don't have safe access to do that unattended. 2. Set the real values via ansible-vault. I have no ansible-vault password for this repo, so I can't create/update encrypted group_vars/host_vars with the new secrets myself. Until that's done, rerunning configure-grafana-observability.yml / install-ntp-ha.yml / install-proxmox-dns-ha.yml / install-authentik-ha.yml will push the literal string "changeMeInVault" as the live credential -- please don't rerun those playbooks until vault overrides are in place. 3. Git history still contains the old plaintext secrets. Rotating the live credentials (item 1) is what actually neutralizes the exposure; scrubbing history is optional cleanup on top of that and I'm not doing it without explicit sign-off (it rewrites history for everyone with a clone). Proposal: rotate InfluxDB token + both keepalived auth strings, store the new values in group_vars/host_vars via ansible-vault, then merge #225. Let me know if you want anything else done here (e.g. deleting the immich role entirely instead of just placeholder-ing its secrets).
claude-bot commented 2026-07-14 10:28:59 +00:00
Author
Member
Copy Link
Copy Source

Update / correction: my liveness assessment above was wrong. The owner confirmed on #225 that all five roles here (immich, grafana-observability, postgres-simple-ha, keepalived-ntp, keepalived-vip) are decommissioned legacy — I had incorrectly treated ansible inventory presence as evidence of liveness, but the inventory carries stale entries for services migrated into the k8s cluster.

PR #225 has been reworked accordingly: instead of sanitizing secrets in dead files, it now deletes all five legacy role directories plus the plays that exclusively drive them (install-immich, configure-grafana-observability, backup-immich-db, configure-immich-db-password), and edits plays/update.yml so the CI update path doesn't break on the removed immich import.

Three HA plays were deliberately left in place (flagged on #225 for an owner decision) because they also reference companion roles not confirmed legacy — install-ntp-ha.yml/chrony-ntp-server, install-proxmox-dns-ha.yml/proxmox-dns (still live), install-authentik-ha.yml/authentik-stateless.

Cross-refs: this overlaps #208 (decommission sweep — immich item now owned here) and #189 (postgres-simple-ha pg_hba, whose target role #225 deletes). I attempted to note this on those issues directly but that's outside this task's "#198-only" communication scope, so recording it here and in the #225 description instead.

Update / correction: my liveness assessment above was **wrong**. The owner confirmed on #225 that all five roles here (immich, grafana-observability, postgres-simple-ha, keepalived-ntp, keepalived-vip) are decommissioned legacy — I had incorrectly treated ansible inventory presence as evidence of liveness, but the inventory carries stale entries for services migrated into the k8s cluster. PR #225 has been reworked accordingly: instead of sanitizing secrets in dead files, it now **deletes** all five legacy role directories plus the plays that exclusively drive them (install-immich, configure-grafana-observability, backup-immich-db, configure-immich-db-password), and edits `plays/update.yml` so the CI update path doesn't break on the removed immich import. Three HA plays were deliberately left in place (flagged on #225 for an owner decision) because they also reference companion roles not confirmed legacy — `install-ntp-ha.yml`/chrony-ntp-server, `install-proxmox-dns-ha.yml`/proxmox-dns (still live), `install-authentik-ha.yml`/authentik-stateless. Cross-refs: this overlaps #208 (decommission sweep — immich item now owned here) and #189 (postgres-simple-ha pg_hba, whose target role #225 deletes). I attempted to note this on those issues directly but that's outside this task's "#198-only" communication scope, so recording it here and in the #225 description instead.
claude-bot commented 2026-07-14 10:31:49 +00:00
Author
Member
Copy Link
Copy Source

Live-verification green-light for the 3 flagged HA plays. The reworked PR correctly left install-authentik-ha.yml, install-proxmox-dns-ha.yml, and install-ntp-ha.yml for owner decision. The live pass now confirms all three target decommissioned hosts: authentik-db-* -> NXDOMAIN (replaced by in-cluster ak-pg); proxmox-dns-1/2/3 + VIP 10.2.40.53 -> NXDOMAIN/no-response; the NTP-HA VIP 10.2.40.4 -> no response. So those 3 plays and their companion roles are safe to delete too. Full map on #208. Thank you for catching the inventory-presence != liveness error - it was mine, not just the agent's.

**Live-verification green-light for the 3 flagged HA plays.** The reworked PR correctly left `install-authentik-ha.yml`, `install-proxmox-dns-ha.yml`, and `install-ntp-ha.yml` for owner decision. The live pass now confirms all three target decommissioned hosts: `authentik-db-*` -> NXDOMAIN (replaced by in-cluster `ak-pg`); `proxmox-dns-1/2/3` + VIP 10.2.40.53 -> NXDOMAIN/no-response; the NTP-HA VIP `10.2.40.4` -> no response. So those 3 plays and their companion roles are safe to delete too. Full map on #208. Thank you for catching the inventory-presence != liveness error - it was mine, not just the agent's.
claude-bot commented 2026-07-14 19:16:55 +00:00
Author
Member
Copy Link
Copy Source

Resolved by PR #225 — closing. All five roles carrying these plaintext values were deleted in #225, and the live-verification pass confirmed every one targets a decommissioned host (immich.srv, grafana.srv, and the keepalived HA VIPs — all NXDOMAIN, superseded by in-cluster equivalents). So these were dead credentials for retired services, not live secrets: the files are gone and no rotation is needed. (The live in-cluster InfluxDB uses a separate OpenBao-managed token via the influxdb-bootstrap ExternalSecret, which is unaffected.)

**Resolved by PR #225 — closing.** All five roles carrying these plaintext values were deleted in #225, and the live-verification pass confirmed every one targets a **decommissioned** host (immich.srv, grafana.srv, and the keepalived HA VIPs — all NXDOMAIN, superseded by in-cluster equivalents). So these were dead credentials for retired services, not live secrets: the files are gone and no rotation is needed. (The live in-cluster InfluxDB uses a separate OpenBao-managed token via the influxdb-bootstrap ExternalSecret, which is unaffected.)
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
apollo
Hermes expert: Immich, Audiobookshelf, Libation, Navidrome, Music Assistant
 atlas
Hermes expert: Talos, Flux, network, Authentik, Matrix, monitoring
 clio
Hermes expert: Paperless, wiki, ical-proxy, TRMNL, websites
 daedalus
Hermes expert: Gitea, Woodpecker, Renovate, review-bot, Hermes
 hestia
Hermes expert: Home Assistant, IoT, MQTT, ESPHome, voice
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
alert-monitor-bot claude-bot (Claude Bot) flux hermes-bot issue-fix-bot k.renner renovate-bot review-bot (Review Bot) security-bot update-audit-bot
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: konairius/homelab#198