From 60248bfd926b87a22ae203df1c4863eb214e8e34 Mon Sep 17 00:00:00 2001 From: turn-secret-rotation Date: Sat, 1 Aug 2026 12:00:00 +0000 Subject: [PATCH] chore(coturn): automated TURN shared-secret rotation Scheduled rotation (Issue #38). New secret generated, re-encrypted with the scoped rotation age key, checksum/rotated-at annotations bumped so Flux restarts coturn + synapse-main on merge. Please review and merge. --- apps/production/coturn-secret.yaml | 6 +++--- apps/production/coturn.yaml | 2 +- apps/production/kustomization.yaml | 2 +- apps/production/synapse-turn-secret.yaml | 6 +++--- 4 files changed, 8 insertions(+), 8 deletions(-) diff --git a/apps/production/coturn-secret.yaml b/apps/production/coturn-secret.yaml index ae06d42..fc59bad 100644 --- a/apps/production/coturn-secret.yaml +++ b/apps/production/coturn-secret.yaml @@ -4,7 +4,7 @@ metadata: name: coturn-secret namespace: matrix stringData: - TURN_SECRET: ENC[AES256_GCM,data:gab4MSNlRANQz/T/Xn0Z45tkUvQ3Uxn5u0MyYfhZTan49P865UbX4rYPf/KmKsekdwFdOGBzvCgcwxhddVbZ1w==,iv:INbz5UUxgA6xdsPBp5W9Mwe+kd9dhHh2Rx5l3yeNRIQ=,tag:dgk/iFjvst7Wul9Lai2QEQ==,type:str] + TURN_SECRET: ENC[AES256_GCM,data:Cbu5SoxQp0L9WFZFbEiyK8j0IJuSgoJE9OpRKZVXyF+PcTM+ewD+3TI8xq+g0C34XDWeaJdxaj3B4yyKsqQLIA==,iv:lW8lD3D75Z0b0EfBj5myUrv4GWMvRTBELjhCVm+QJjc=,tag:nC5L/PcYPoLJP1whSSfSTA==,type:str] sops: age: - enc: | @@ -26,6 +26,6 @@ sops: -----END AGE ENCRYPTED FILE----- recipient: age1x4jjwc8nuttwr8us924pvdc6dll5npkc6c8f4zf2hx5d2qu75dtqx0fm0d encrypted_regex: ^(data|stringData)$ - lastmodified: "2026-07-28T19:26:57Z" - mac: ENC[AES256_GCM,data:zU3i1WGY1X4igBYzfC1WAWdtMQZWGBSacaJpXnUVt6+BCfucqaH807IRWpWbTR0+xuLteaqcdXuVuAlStqs/VV586Q4cD2FfWDeBq/O09HEwTrfekTjAyyu7zCFyZ2ja+kB4DQ83NoscCiNwNmfTZF+6RzMqx7yphPxK5go1r7c=,iv:6FIYWsNvz78zJscbxyDgy1u6ur20MnOMkMcsA4329OI=,tag:uSDpAWEixGcVmtOloMoKuw==,type:str] + lastmodified: "2026-08-01T02:00:01Z" + mac: ENC[AES256_GCM,data:1Tx2/4O/fcv9BPYLXainmsILC2HbBJtJkgVnbkCe9oVSKca/hVf6zAa8Pd6n/tvHHAuU1Ghm2mglk/IxbNKgCDHH+xaEeK5sfhAK0Ot2ffIMLK5chBNMH0DpvTjqP8ttMidgPJ4XYzizB850gq7pSRrZBJCC2oG66F+WPnfKkxQ=,iv:NIDfNbIyWSgvjpXtQFVjnZFjtKx8sV3a45ssiebkHf0=,tag:hNDmHPTu4RyNMvjyfJRCmA==,type:str] version: 3.12.2 diff --git a/apps/production/coturn.yaml b/apps/production/coturn.yaml index 03ce308..bee5301 100644 --- a/apps/production/coturn.yaml +++ b/apps/production/coturn.yaml @@ -88,7 +88,7 @@ spec: # Bumped on every TURN_SECRET rotation (Issue #38) to force a new pod, since # Kubernetes doesn't restart running pods when a referenced Secret's content # changes and the initContainer that reads it only runs once at pod start. - rotated-at: "2026-07-28T19:26:57Z" + rotated-at: "2026-08-01T02:00:01Z" spec: hostNetwork: true dnsPolicy: ClusterFirstWithHostNet diff --git a/apps/production/kustomization.yaml b/apps/production/kustomization.yaml index c50e8e1..346f019 100644 --- a/apps/production/kustomization.yaml +++ b/apps/production/kustomization.yaml @@ -16,7 +16,7 @@ patches: value: "401f8a87d0ef5d91d2e5032d4aede42c" - op: add path: /metadata/annotations/turn-secret-checksum - value: "d220c0e4ff8f7106328c8827d47e8734" + value: "05aad8b742fb02c42f4c1a5629ae31e1" resources: - matrix-postgres-auth.yaml diff --git a/apps/production/synapse-turn-secret.yaml b/apps/production/synapse-turn-secret.yaml index 6e0fdd6..f7adf87 100644 --- a/apps/production/synapse-turn-secret.yaml +++ b/apps/production/synapse-turn-secret.yaml @@ -4,7 +4,7 @@ metadata: name: synapse-turn-secret namespace: matrix stringData: - values.yaml: ENC[AES256_GCM,data:An+GypE/btGmfnvL1rPzvbN1sAnZKQnHV20GxXkZiRb+Wi8BymAUA6JRBo5mdtvK1dgDMF6H1wN+Y7wjzwduteaoskVfgd7Xw+lL1SrZ/6pchGxlUIWSJlLTmp6IHZaruleDUsCKdrWfN9TQDE+WYdiECBktlGGXs8ZZMTzjHmHKJ3tNwSimaxuG662Amb0LiHLX+zBUKOuG0L4cWrp6JI3NKQFgNNiF6xwXjHDX550bGOQ2pi5UVPL9+HlH2tPeTzoCCZdJLWF+2kZg31bZ7dzRp8M23eDrzfGC9e9m0NrA2z1ljagbnuT0tixp6J8205qfBOIOVOWbXHmd/LQ8nphA64En6JXqU8XeZ+mgMUmFuGwyewLq4oilLoQfdZujEyGhc9Hd/yonRlc/RDBlONlI8d+IWqZxf0AaUYEAe9uE6MulqRs0CowPUpCmWtZjz68qQlIvJEAqxNdWEnp+SkExDNNe9y8tBOCXy726TRX0MLIlZ+CjPDCHhwDeKw5oQU0wXr9QezY=,iv:bPK1+PViBg046N3q2Eb1ZOJOYv7X/HgpCEU/MLp7o6k=,tag:/2Kyv7aB4baOL+3KdAeQ9w==,type:str] + values.yaml: ENC[AES256_GCM,data:jGoBDvjGymp4qEVEB6hzgRJk1ZUVB+jNxfhqpl7tG7UQmZGskix43rMJIOdDZihBTOUHP4emhlOzTxqx3SCAFCb8Ie78xA+DfjuLnQ6PQ2jqN48+yc7QE2xbNr5eWlYYKzl1u/z0kCQT723ptA+tQzYCzUq5U624HHxki0firgoSJmaF9S/vbwXHLPqtnviYX48Eim0suwMnavWdWGd1X3yvqUoZnWKz3eDQrH3cp4fQAdnRosveIcWwz+1na67Zshczq7hhlNp/WZ95guAOiqlLxGMPwJQJou24UYynwQTtDle5IzCxOww+sCNuQtPp29NE1gZ5pxIM7Ys6Ul7UxtPAww6OCVbkYYGmQxIq0cY4CrFrgLDJYQ2JJPIexc1ooeIDcYiNYts/2TCAj9ck+Vd+6xN1NEYwm0ZTLL9naLJJ1PEzRkfy3bCOTfKWCRNwLzn/3gsRgr+hrf5dJ6Av6VbM0Ae9xhTEQ4d64C8YRjb4G9BnDRGuaHu+5DYAqiFUEMm6cM4IV3E=,iv:ZRGQREujdrDCNj1OcgV7HAjZREArdnodnD2J5BxkGQo=,tag:2FOO9/rv4IteyulLnsR/YA==,type:str] sops: age: - enc: | @@ -26,6 +26,6 @@ sops: -----END AGE ENCRYPTED FILE----- recipient: age1x4jjwc8nuttwr8us924pvdc6dll5npkc6c8f4zf2hx5d2qu75dtqx0fm0d encrypted_regex: ^(data|stringData)$ - lastmodified: "2026-07-28T19:26:57Z" - mac: ENC[AES256_GCM,data:UfD+QJel9FygoKPM02KdOLvP1id/21ghQ0uWAQJxEs/w+B2vVkpe/dXSJ7QnI0e528ns1HW81GAxkxyAupsUDq8/pBdEQgItwDs5DIgHvH+sTPAtj2Kyq2wMOeEt+XDGLRdOlAwbcKDS/LyfeZ5b9QnAbY2w/tTinTkzEvbudT8=,iv:WmmwjAmZmM0W8dvqBcv9XYZkYtan3lg0Sb8ypVuGoJk=,tag:3yzZhSFtbSbLUXSdDWGAtw==,type:str] + lastmodified: "2026-08-01T02:00:01Z" + mac: ENC[AES256_GCM,data:zk0ivb9asZLHUg819tR8GV5R5ViSiJId0T1o2GqYWjc/AcNK1pBKwIJ+S3TuB0fLz3qaFXUBfzcc+CfztuTLcRzAfu3mF8Hv0boZTe0lGl5XugmozQWjoLjSw+roWZHlXd5CfYbDZsHSO70231NyPlpuUkVr2fqAFZgTEev2A9Y=,iv:IkRYK6PLE74i+Kq5fop4ddS+Q9KW8uNVfABK81uFyIw=,tag:kanZfzBXEYodnQtwWdZ85g==,type:str] version: 3.13.3