konairius/homelab
10
0
Fork 0
Code Issues 8 Pull Requests 2 Packages Projects Releases 1 Wiki Activity

feat(crowdsec): automated bouncer-key rotation (openbao-ns) #303

Merged
gitea_admin merged 3 commits from feat/crowdsec-bouncer-key-rotation into master 2026-07-18 21:27:05 +00:00
Conversation 0 Commits 3 Files Changed 6
+134 -4
claude-bot commented 2026-07-18 20:09:18 +00:00
Member
Copy Link
Copy Source

Fan-out #3. Rotates crowdsec-bouncer-key:key — self-sync 2-sided (one KV path → both crowdsec + ingress ns Secrets; Reloader restarts crowdsec-lapi). Per-secret rotator-crowdsec-bouncer role/policy, no netpol; both ExternalSecrets refreshInterval 1h→10m.

⚠️ Landmine handled: traefik/crowdsec-middleware.yaml carries a third, hardcoded copy of this key (not Secret-sourced). That middleware is currently inert (unattached), so nothing breaks today — but a loud guard comment now warns it must be refreshed from OpenBao (bao kv get homelab/infrastructure/crowdsec-bouncer-key) before it's ever re-enabled, or the bouncer 401s with a stale key. Needs the one-time OpenBao bootstrap. kustomize clean.

Fan-out #3. Rotates `crowdsec-bouncer-key:key` — self-sync 2-sided (one KV path → both crowdsec + ingress ns Secrets; Reloader restarts `crowdsec-lapi`). Per-secret `rotator-crowdsec-bouncer` role/policy, no netpol; both ExternalSecrets refreshInterval 1h→10m. ⚠️ **Landmine handled**: `traefik/crowdsec-middleware.yaml` carries a **third, hardcoded** copy of this key (not Secret-sourced). That middleware is currently **inert** (unattached), so nothing breaks today — but a loud guard comment now warns it must be refreshed from OpenBao (`bao kv get homelab/infrastructure/crowdsec-bouncer-key`) before it's ever re-enabled, or the bouncer 401s with a stale key. Needs the one-time OpenBao bootstrap. kustomize clean.
claude-bot added 1 commit 2026-07-18 20:09:18 +00:00
feat(crowdsec): automated bouncer-key rotation (openbao-ns) ad5ea965e3 
Rotates crowdsec-bouncer-key:key quarterly + on-demand via the openbao-ns pattern (per-secret rotator-crowdsec-bouncer role/policy, no netpol). Self-sync: the single KV path feeds both the crowdsec + ingress ns Secrets; Reloader restarts crowdsec-lapi. Both ExternalSecrets refreshInterval 1h->10m.
CAVEAT handled: traefik/crowdsec-middleware.yaml has a THIRD hardcoded copy of this key (not Secret-sourced) — that middleware is inert, and a loud guard comment now warns it must be refreshed from OpenBao before re-enabling. Requires the one-time OpenBao bootstrap.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015K7gLUVVnutvDnzV2TrMRJ
claude-bot added 1 commit 2026-07-18 21:24:45 +00:00
Merge remote-tracking branch 'origin/master' into feat/crowdsec-bouncer-key-rotation 6d28ab21ea 
# Conflicts:
#	kubernetes/infrastructure/openbao/rotation/kustomization.yaml
claude-bot added 1 commit 2026-07-18 21:26:44 +00:00
Merge remote-tracking branch 'origin/master' into feat/crowdsec-bouncer-key-rotation 61456ddccc 
# Conflicts:
#	kubernetes/infrastructure/openbao/rotation/kustomization.yaml
gitea_admin merged commit b173f64976 into master 2026-07-18 21:27:05 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
apollo
Hermes expert: Immich, Audiobookshelf, Libation, Navidrome, Music Assistant
 atlas
Hermes expert: Talos, Flux, network, Authentik, Matrix, monitoring
 clio
Hermes expert: Paperless, wiki, ical-proxy, TRMNL, websites
 daedalus
Hermes expert: Gitea, Woodpecker, Renovate, review-bot, Hermes
 hestia
Hermes expert: Home Assistant, IoT, MQTT, ESPHome, voice
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
alert-monitor-bot claude-bot (Claude Bot) flux hermes-bot issue-fix-bot k.renner renovate-bot review-bot (Review Bot) security-bot update-audit-bot
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: konairius/homelab#303