sorb/axion1337.chat-gitops
1
0
Fork 0
Code Issues Pull Requests Packages Projects 1 Releases 24 Wiki Activity
223 Commits 2 Branches 24 Tags
d10a9285b933794b1e264fbe25ae1532cfefa2b1
Commit Graph
5 Commits
Author SHA1 Message Date
turn-secret-rotation d10a9285b9 chore(coturn): automated TURN shared-secret rotation 
Scheduled rotation (Issue #38). New secret generated, re-encrypted with
the scoped rotation age key, checksum/rotated-at annotations bumped so
Flux restarts coturn + synapse-main on merge. Please review and merge.
 2026-08-01 02:00:01 +00:00
turn-secret-rotation f30d2f582b chore(coturn): automated TURN shared-secret rotation 
Scheduled rotation (Issue #38). New secret generated, re-encrypted with
the scoped rotation age key, checksum/rotated-at annotations bumped so
Flux restarts coturn + synapse-main on merge. Please review and merge.
 2026-07-28 19:26:57 +00:00
Thore CimbalandClaude Sonnet 5 5bcbadd06a feat(coturn): add scoped age recipient for automated rotation job
Auto-Deploy on Push / verify-and-notify (push) Canceled after 0s 
Adds a second age recipient (dedicated keypair, private key never touches
the repo) to just these two files, so the upcoming rotation CronJob can
decrypt/re-encrypt them without needing the repo's master sops-age key,
which can decrypt every secret in the repo. Verified: master key still
decrypts both files; the new scoped key can decrypt both files but
correctly cannot decrypt an unrelated secret (authentik-secret.yaml).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
 2026-07-28 21:13:27 +02:00
Thore CimbalandClaude Sonnet 5 0242238597 fix(coturn): remove plaintext TURN shared secret, rotate leaked value
Auto-Deploy on Push / verify-and-notify (push) Canceled after 0s 
Issue #38 discussion surfaced a real bug: the TURN shared secret was
duplicated - correctly SOPS-encrypted in coturn-secret.yaml, but also
hardcoded in plaintext in synapse-values.yaml (a plain, non-SOPS
ConfigMap), visible in git history. Also found turn_user_lifetime is
86400000ms (24h), not "short-lived" as previously assumed - raising the
stakes of the leak somewhat.

Extracted the turn config block into its own dedicated SOPS-encrypted
Secret (synapse-turn-secret.yaml), wired via a second HelmRelease
valuesFrom entry (same pattern already used for ess-mas-values-secret).
Rotated the value while doing this, so the leaked plaintext secret is no
longer live anywhere.

Added checksum/rotated-at annotations (matrix-stack HelmRelease's
existing element-config-checksum patch gets a sibling turn-secret-checksum;
coturn's Deployment pod template gets a rotated-at annotation) so future
rotations actually restart both consumers - Kubernetes doesn't restart
running pods when a referenced Secret's content changes on its own.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
 2026-07-28 21:05:07 +02:00
Scrublord MacBadandClaude Haiku 4.5 8ff438bd24 Implement TURN server (coturn) for WebRTC video calls 
Add coturn Deployment with hostNetwork mode and init container for secret substitution. Include SOPS-encrypted shared secret, TLS certificate for turn.axion1337.chat, and Synapse TURN configuration with proper relay URIs and credentials.

Resolves DTLS timeout issues in RTC video calls by providing media relay for clients behind NAT/Firewall.

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
 2026-04-29 23:07:52 +02:00