From fc577ba89b7ad9428ee94370c765b7369052fedb Mon Sep 17 00:00:00 2001 From: turn-secret-rotation Date: Tue, 1 Sep 2026 02:00:01 +0000 Subject: [PATCH] chore(coturn): automated TURN shared-secret rotation Scheduled rotation (Issue #38). New secret generated, re-encrypted with the scoped rotation age key, checksum/rotated-at annotations bumped so Flux restarts coturn + synapse-main on merge. Please review and merge. --- apps/production/coturn-secret.yaml | 6 +++--- apps/production/coturn.yaml | 2 +- apps/production/kustomization.yaml | 2 +- apps/production/synapse-turn-secret.yaml | 6 +++--- 4 files changed, 8 insertions(+), 8 deletions(-) diff --git a/apps/production/coturn-secret.yaml b/apps/production/coturn-secret.yaml index fc59bad..b38c21c 100644 --- a/apps/production/coturn-secret.yaml +++ b/apps/production/coturn-secret.yaml @@ -4,7 +4,7 @@ metadata: name: coturn-secret namespace: matrix stringData: - TURN_SECRET: ENC[AES256_GCM,data:Cbu5SoxQp0L9WFZFbEiyK8j0IJuSgoJE9OpRKZVXyF+PcTM+ewD+3TI8xq+g0C34XDWeaJdxaj3B4yyKsqQLIA==,iv:lW8lD3D75Z0b0EfBj5myUrv4GWMvRTBELjhCVm+QJjc=,tag:nC5L/PcYPoLJP1whSSfSTA==,type:str] + TURN_SECRET: ENC[AES256_GCM,data:ATip8K3DKFyyInoJ9/e6SGJobGNruDgNn8fGopkct2cbTHKXduIZWjMEaZ4y47XS5d52qjbHSGSNm/uATsnN3A==,iv:vcGxyduSlqQPZv7fVmWgUypaSSMCDxF2m8WnDiiRaq0=,tag:P+lZAzQZYK5NY7KIr8igug==,type:str] sops: age: - enc: | @@ -26,6 +26,6 @@ sops: -----END AGE ENCRYPTED FILE----- recipient: age1x4jjwc8nuttwr8us924pvdc6dll5npkc6c8f4zf2hx5d2qu75dtqx0fm0d encrypted_regex: ^(data|stringData)$ - lastmodified: "2026-08-01T02:00:01Z" - mac: ENC[AES256_GCM,data:1Tx2/4O/fcv9BPYLXainmsILC2HbBJtJkgVnbkCe9oVSKca/hVf6zAa8Pd6n/tvHHAuU1Ghm2mglk/IxbNKgCDHH+xaEeK5sfhAK0Ot2ffIMLK5chBNMH0DpvTjqP8ttMidgPJ4XYzizB850gq7pSRrZBJCC2oG66F+WPnfKkxQ=,iv:NIDfNbIyWSgvjpXtQFVjnZFjtKx8sV3a45ssiebkHf0=,tag:hNDmHPTu4RyNMvjyfJRCmA==,type:str] + lastmodified: "2026-09-01T02:00:01Z" + mac: ENC[AES256_GCM,data:SNMa4VdFzNY5cC3Rv53XhH7J9ptePn5LQR6038m09zOaGa6M9iXrK6f3SgSh8+53u40IewyFf/5ZjwH7d7O08r3uZp+VPcEovubElqbQ6in/YPkWGZ/M1rDJ4y1JM5FlfcYHRqzbTsDwJco7SoYtUthSrmQDIX+Bdb04ZgwzTuQ=,iv:D9ZVhMk71lGaFFrdzeosRB4IJMxzic96QqUAkaCLPrk=,tag:feWHR1RQaroIvJlT80vluQ==,type:str] version: 3.12.2 diff --git a/apps/production/coturn.yaml b/apps/production/coturn.yaml index 2b97e19..e8a4942 100644 --- a/apps/production/coturn.yaml +++ b/apps/production/coturn.yaml @@ -88,7 +88,7 @@ spec: # Bumped on every TURN_SECRET rotation (Issue #38) to force a new pod, since # Kubernetes doesn't restart running pods when a referenced Secret's content # changes and the initContainer that reads it only runs once at pod start. - rotated-at: "2026-08-01T02:00:01Z" + rotated-at: "2026-09-01T02:00:01Z" spec: hostNetwork: true dnsPolicy: ClusterFirstWithHostNet diff --git a/apps/production/kustomization.yaml b/apps/production/kustomization.yaml index 7a69624..2f28bbc 100644 --- a/apps/production/kustomization.yaml +++ b/apps/production/kustomization.yaml @@ -16,7 +16,7 @@ patches: value: "401f8a87d0ef5d91d2e5032d4aede42c" - op: add path: /metadata/annotations/turn-secret-checksum - value: "05aad8b742fb02c42f4c1a5629ae31e1" + value: "fd34214736091bf3ced17afe7bb4d61f" resources: - matrix-postgres-auth.yaml diff --git a/apps/production/synapse-turn-secret.yaml b/apps/production/synapse-turn-secret.yaml index f7adf87..8591913 100644 --- a/apps/production/synapse-turn-secret.yaml +++ b/apps/production/synapse-turn-secret.yaml @@ -4,7 +4,7 @@ metadata: name: synapse-turn-secret namespace: matrix stringData: - values.yaml: ENC[AES256_GCM,data:jGoBDvjGymp4qEVEB6hzgRJk1ZUVB+jNxfhqpl7tG7UQmZGskix43rMJIOdDZihBTOUHP4emhlOzTxqx3SCAFCb8Ie78xA+DfjuLnQ6PQ2jqN48+yc7QE2xbNr5eWlYYKzl1u/z0kCQT723ptA+tQzYCzUq5U624HHxki0firgoSJmaF9S/vbwXHLPqtnviYX48Eim0suwMnavWdWGd1X3yvqUoZnWKz3eDQrH3cp4fQAdnRosveIcWwz+1na67Zshczq7hhlNp/WZ95guAOiqlLxGMPwJQJou24UYynwQTtDle5IzCxOww+sCNuQtPp29NE1gZ5pxIM7Ys6Ul7UxtPAww6OCVbkYYGmQxIq0cY4CrFrgLDJYQ2JJPIexc1ooeIDcYiNYts/2TCAj9ck+Vd+6xN1NEYwm0ZTLL9naLJJ1PEzRkfy3bCOTfKWCRNwLzn/3gsRgr+hrf5dJ6Av6VbM0Ae9xhTEQ4d64C8YRjb4G9BnDRGuaHu+5DYAqiFUEMm6cM4IV3E=,iv:ZRGQREujdrDCNj1OcgV7HAjZREArdnodnD2J5BxkGQo=,tag:2FOO9/rv4IteyulLnsR/YA==,type:str] + values.yaml: ENC[AES256_GCM,data:xc/pUhIbmGizSCS/P5EI+5zgxyoM7SiHOo9loGmUfQ0iiL+EntJlK4WiaHwpvAwCDA/N+4IrUMp5kBjAnCz/Y4qD/geXz932ccG4mIH1ncD5F/2/mFVN+gqo4q+xwy27wzR1RS2p3hJN7z11HrXazqMIgDvz3EXqeYYD6YnM8Z1IfFdGA+daSSoRDiiqh9XFL7g2aVKomWImxkP4kXU4vJCoXXmd3DF8guZv7zQ1uhJtQOzGHF1cST+pxBV4/+zkpdY7Du7L3cNc7qk/oJNbMh3VEyB6Yi3krcLLbXuTSXZ9qBHhXLrsWngxoXRSo++PIfbqAuJ1iSzQ8Zz0NUbqOS+tILLo/Twe9DjwT5hunIPX1vIN/4SOqPgS0ZQm+VISs5eixxYzAA8xvIbc/0twbWA+33HEo5G6mXe6uzoNqsWE1PKYw7gl7vbVqnTYkyMQXdAPIbfKaW4JQ0zkpeFnJpGdKnYse2xwfofEtV6aiV3eNo1IyUjsp2kN7F4RBd1e1SqrI9nyUcM=,iv:MFc+1fDPK5bg607mMN2sDAufmFzE7hHqEmnejMjmiCI=,tag:pgFMtvcm3a9I+coXMO0xXA==,type:str] sops: age: - enc: | @@ -26,6 +26,6 @@ sops: -----END AGE ENCRYPTED FILE----- recipient: age1x4jjwc8nuttwr8us924pvdc6dll5npkc6c8f4zf2hx5d2qu75dtqx0fm0d encrypted_regex: ^(data|stringData)$ - lastmodified: "2026-08-01T02:00:01Z" - mac: ENC[AES256_GCM,data:zk0ivb9asZLHUg819tR8GV5R5ViSiJId0T1o2GqYWjc/AcNK1pBKwIJ+S3TuB0fLz3qaFXUBfzcc+CfztuTLcRzAfu3mF8Hv0boZTe0lGl5XugmozQWjoLjSw+roWZHlXd5CfYbDZsHSO70231NyPlpuUkVr2fqAFZgTEev2A9Y=,iv:IkRYK6PLE74i+Kq5fop4ddS+Q9KW8uNVfABK81uFyIw=,tag:kanZfzBXEYodnQtwWdZ85g==,type:str] + lastmodified: "2026-09-01T02:00:01Z" + mac: ENC[AES256_GCM,data:VdjLTJSa4ZfWLnola8F4u5q50a9Z6+h+Dbb9MKgGz3v+F2II+u29XrmXDS0Xpqx7QMjpzPdDp4gvyBecXxk5p+nzoC2lHSENvrZsloTQi18wEX04C53IXteoB6ijJ8VR6xC0GyKhXgIxo297dqfndSqgsYmQB5w2WKvzmcb+Ctg=,iv:9AWwKsGiJJMe8qpo534/cZT/2bW4DXeiRhzneSPF24s=,tag:n6bSrwV+9WVMzBsh8ou7OA==,type:str] version: 3.13.3