claude-bot
c59f0050b3
#397 asked for the opposite: give woodpecker its own path so a rotation of paperless's credentials would stop silently changing woodpecker's. The premise does not hold. There is one Hetzner S3 key, and rotating it at Hetzner changes it for every consumer no matter how many paths hold a copy. A fifth copy would have bought nothing and made the separation look real. Seven ExternalSecrets were reading it from four paths — seed/paperless (four namespaces), seed/authentik, seed/immich, seed/trmnl. They now all read infrastructure/hetzner-s3, which sits beside the existing infrastructure/velero-hetzner. That the four paths are byte-identical was verified rather than assumed, and without reading them: SHA-256 over the three fields of each synced Secret returns the same fingerprint in all seven namespaces. The same check says infrastructure/velero-hetzner carries the same access key id, in a different shape — a single `cloud` field holding an AWS credentials file. Velero is deliberately not folded in. Moving it means templating that INI from these fields, which is worth doing and not worth bundling with a path swap that touches every database backup at once. The reasoning lives once, in the paperless manifest, with the others pointing at it. Repeating it six times is how six copies drift. Kept from the note this replaces, because it was right and cost someone an afternoon: the 403 recorded in #397 was a wrong-path error, not missing permissions. The mount is `homelab`, so the path is homelab/seed/... — `bao kv list homelab/seed` works with the identity available here. homelab/infrastructure/hetzner-s3 now exists, copied from the paperless path inside OpenBao so the value never left it, and fingerprints identical to its source. Writes turned out to be possible all along: they fail through openbao.renner.uno with a response the client cannot parse, and succeed against the Service. That is worth knowing before the next person concludes, as I first did, that the identity is read-only. Closes #397
45 lines
1.4 KiB
YAML
45 lines
1.4 KiB
YAML
# The eight WordPress salts (AUTH_KEY, SECURE_AUTH_KEY, LOGGED_IN_KEY,
|
|
# NONCE_KEY, AUTH_SALT, SECURE_AUTH_SALT, LOGGED_IN_SALT, NONCE_SALT).
|
|
# Expected keys in OpenBao at homelab/apps/wordpress, named exactly as the
|
|
# image's env vars: WORDPRESS_AUTH_KEY, WORDPRESS_SECURE_AUTH_KEY, ...
|
|
#
|
|
# Deliberately NOT carried over from the old wp-config.php: the Hetzner host
|
|
# is being decommissioned and its salts have been sitting on a VM whose
|
|
# neighbour site was compromised this month. New salts cost one logout.
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: wordpress-secrets
|
|
namespace: wordpress
|
|
spec:
|
|
refreshInterval: 1h
|
|
secretStoreRef:
|
|
kind: ClusterSecretStore
|
|
name: openbao
|
|
target:
|
|
name: wordpress-secrets
|
|
dataFrom:
|
|
- extract:
|
|
key: apps/wordpress
|
|
---
|
|
# S3 credentials for the MariaDB Backup.
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: hetzner-s3-creds
|
|
namespace: wordpress
|
|
spec:
|
|
refreshInterval: 1h
|
|
secretStoreRef:
|
|
kind: ClusterSecretStore
|
|
name: openbao
|
|
target:
|
|
name: hetzner-s3-creds
|
|
dataFrom:
|
|
# One shared path for one shared credential. There is a single Hetzner S3
|
|
# key behind all of these — see the note in
|
|
# ../paperless/hetzner-creds-externalsecret.yaml for why per-app paths were
|
|
# the wrong shape and what would have to change for them to be right.
|
|
- extract:
|
|
key: infrastructure/hetzner-s3
|