konairius/homelab
10
0
Fork 0
Code Issues 8 Pull Requests 1 Packages Projects Releases 1 Wiki Activity

feat(shelly-manager): automated auth-secret rotation (openbao-ns) #301

Merged
k.renner merged 1 commits from feat/shelly-manager-auth-rotation into master 2026-07-18 21:20:41 +00:00
Conversation 0 Commits 1 Files Changed 5
+124 -1
claude-bot commented 2026-07-18 20:04:01 +00:00
Member
Copy Link
Copy Source

Fan-out #1 (of the 3 safe Class-A secrets) using the openbao-ns rotation pattern. Rotates shelly-manager-auth (admin-password + api-key) — single consumer, opaque values, SIMPLE case. Per-secret rotator-shelly-manager role/policy (no netpol). Reloader restarts shelly-manager; refreshInterval 1h→10m. Rotation forces re-auth on the built-in login + API key (behind the Authentik gate); no data loss. Needs the one-time OpenBao bootstrap before first run. kustomize + build clean.

Fan-out #1 (of the 3 safe Class-A secrets) using the openbao-ns rotation pattern. Rotates `shelly-manager-auth` (admin-password + api-key) — single consumer, opaque values, SIMPLE case. Per-secret `rotator-shelly-manager` role/policy (no netpol). Reloader restarts shelly-manager; refreshInterval 1h→10m. Rotation forces re-auth on the built-in login + API key (behind the Authentik gate); no data loss. Needs the one-time OpenBao bootstrap before first run. kustomize + build clean.
claude-bot added 1 commit 2026-07-18 20:04:01 +00:00
feat(shelly-manager): automated auth-secret rotation (openbao-ns) 5c0412b86a 
Rotates shelly-manager-auth (admin-password + api-key) quarterly + on-demand via the openbao-ns pattern (per-secret rotator-shelly-manager role/policy, no netpol). Reloader restarts shelly-manager; externalsecret refreshInterval 1h->10m. Requires the one-time OpenBao bootstrap (rotator-shelly-manager.hcl).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015K7gLUVVnutvDnzV2TrMRJ
k.renner merged commit e0e42f763e into master 2026-07-18 21:20:41 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
apollo
Hermes expert: Immich, Audiobookshelf, Libation, Navidrome, Music Assistant
 atlas
Hermes expert: Talos, Flux, network, Authentik, Matrix, monitoring
 clio
Hermes expert: Paperless, wiki, ical-proxy, TRMNL, websites
 daedalus
Hermes expert: Gitea, Woodpecker, Renovate, review-bot, Hermes
 hestia
Hermes expert: Home Assistant, IoT, MQTT, ESPHome, voice
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
alert-monitor-bot claude-bot (Claude Bot) flux hermes-bot issue-fix-bot k.renner renovate-bot review-bot (Review Bot) security-bot update-audit-bot
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: konairius/homelab#301