From f30d2f582ba14d85a7dec97c4db9bb2677ca824d Mon Sep 17 00:00:00 2001 From: turn-secret-rotation Date: Tue, 28 Jul 2026 19:26:57 +0000 Subject: [PATCH] chore(coturn): automated TURN shared-secret rotation Scheduled rotation (Issue #38). New secret generated, re-encrypted with the scoped rotation age key, checksum/rotated-at annotations bumped so Flux restarts coturn + synapse-main on merge. Please review and merge. --- apps/production/coturn-secret.yaml | 6 +++--- apps/production/coturn.yaml | 2 +- apps/production/kustomization.yaml | 4 ++-- apps/production/synapse-turn-secret.yaml | 6 +++--- 4 files changed, 9 insertions(+), 9 deletions(-) diff --git a/apps/production/coturn-secret.yaml b/apps/production/coturn-secret.yaml index a790de8..ae06d42 100644 --- a/apps/production/coturn-secret.yaml +++ b/apps/production/coturn-secret.yaml @@ -4,7 +4,7 @@ metadata: name: coturn-secret namespace: matrix stringData: - TURN_SECRET: ENC[AES256_GCM,data:ZLp9/NqMZ+nrU8hUdwKndBjBh6Qa94O3UUuT71E8XDt5mP6+uZeVab27IqssqNJ6+T9tuj5uw5Q9Pj3NK6rERw==,iv:t4nvWH4rqWDHDzYOrrESwwtqMQ6YJ2CQzVbcyaYiaYM=,tag:5/LDvbVVj+a5TLjLBci1Dw==,type:str] + TURN_SECRET: ENC[AES256_GCM,data:gab4MSNlRANQz/T/Xn0Z45tkUvQ3Uxn5u0MyYfhZTan49P865UbX4rYPf/KmKsekdwFdOGBzvCgcwxhddVbZ1w==,iv:INbz5UUxgA6xdsPBp5W9Mwe+kd9dhHh2Rx5l3yeNRIQ=,tag:dgk/iFjvst7Wul9Lai2QEQ==,type:str] sops: age: - enc: | @@ -26,6 +26,6 @@ sops: -----END AGE ENCRYPTED FILE----- recipient: age1x4jjwc8nuttwr8us924pvdc6dll5npkc6c8f4zf2hx5d2qu75dtqx0fm0d encrypted_regex: ^(data|stringData)$ - lastmodified: "2026-07-28T19:13:00Z" - mac: ENC[AES256_GCM,data:i2dEOiO1K1RNoGgkJyZf7eGix0yaqSwbeE1NOQf72alyA8bM8p5ufz6X2P49OUmw2d8vjsJ40sTTSUcnI2/ZoeFJ24jEN7N6pVj2Wy9DkBynIlnPWvVxa347T6/yToPp3neLreH1ap+I50FUcnK50hS+TpRHtSW+9Js5oxrJxTQ=,iv:yFmrcDr2gW1EJRNSSQ8Ie3PXS4bNFqiK5Bbvy6IGlHE=,tag:G1vn8StyJFpl+duZHb0vPg==,type:str] + lastmodified: "2026-07-28T19:26:57Z" + mac: ENC[AES256_GCM,data:zU3i1WGY1X4igBYzfC1WAWdtMQZWGBSacaJpXnUVt6+BCfucqaH807IRWpWbTR0+xuLteaqcdXuVuAlStqs/VV586Q4cD2FfWDeBq/O09HEwTrfekTjAyyu7zCFyZ2ja+kB4DQ83NoscCiNwNmfTZF+6RzMqx7yphPxK5go1r7c=,iv:6FIYWsNvz78zJscbxyDgy1u6ur20MnOMkMcsA4329OI=,tag:uSDpAWEixGcVmtOloMoKuw==,type:str] version: 3.12.2 diff --git a/apps/production/coturn.yaml b/apps/production/coturn.yaml index 53fad08..03ce308 100644 --- a/apps/production/coturn.yaml +++ b/apps/production/coturn.yaml @@ -88,7 +88,7 @@ spec: # Bumped on every TURN_SECRET rotation (Issue #38) to force a new pod, since # Kubernetes doesn't restart running pods when a referenced Secret's content # changes and the initContainer that reads it only runs once at pod start. - rotated-at: "2026-07-28T19:02:00Z" + rotated-at: "2026-07-28T19:26:57Z" spec: hostNetwork: true dnsPolicy: ClusterFirstWithHostNet diff --git a/apps/production/kustomization.yaml b/apps/production/kustomization.yaml index df2bea1..85b5941 100644 --- a/apps/production/kustomization.yaml +++ b/apps/production/kustomization.yaml @@ -16,7 +16,7 @@ patches: value: "401f8a87d0ef5d91d2e5032d4aede42c" - op: add path: /metadata/annotations/turn-secret-checksum - value: "9b0383df36943da3b32198b6bd32bfcd" + value: "d220c0e4ff8f7106328c8827d47e8734" resources: - matrix-postgres-auth.yaml @@ -42,4 +42,4 @@ resources: - synapse-backup.yaml # Automatisierte TURN-Secret-Rotation (Issue #38) - turn-secret-rotation-secret.yaml - - turn-secret-rotation.yaml \ No newline at end of file + - turn-secret-rotation.yaml diff --git a/apps/production/synapse-turn-secret.yaml b/apps/production/synapse-turn-secret.yaml index e2c3cdf..6e0fdd6 100644 --- a/apps/production/synapse-turn-secret.yaml +++ b/apps/production/synapse-turn-secret.yaml @@ -4,7 +4,7 @@ metadata: name: synapse-turn-secret namespace: matrix stringData: - values.yaml: ENC[AES256_GCM,data:/i/7U40uJ11Zl5/882qWzyWOI0sdzGdyvPrvImM6xULCb3t91D2sXLJK19DMnG5b2XARgN/PDmXhK/yux8OZzj3pDac8dNvgrhqL7peAuf61TWUtqmse+6V5P5ajaeVuWnbsSSrTZKg6HZY0Olzd34qsMSwmFp5FPcROSfPwxMuTqHG1OBaRzcIiIEna6rGZ8jItsqimDa0ce6nZ16t0nRFlhHVGMKZxc8Ctb56W2TRmyk8mh3VArhA/PI+tMwFKwUy00Gotywd6wvug0dgRk+EcHJrSCyDQQvTgLFzHlhbB2hZs5zRyCNc4ipvSJtMl1gG5I+rDabFIz6+4/f0wHyuCED0Tr4TMWwibbHBOy1xObS8Dk7eBMDxNykhCKriHdNgGimzyutOGfqm6EVRY6+22aHAzEkMNaaN4zfSkVIbmGl5TMsaRhdZGb1vSfkToLAJPxk9Tpjer/5DJ7dui2b0HkqJ1oAUDdpXzgm05mn7CW/LN7JwzBo2IOn1izzCK5OU4KrzqPJFz,iv:+DYUBkJC8FZIl+mXc5NWv1EfSRWq+ho1huwTerFhZwM=,tag:HoSC13tQzd8GT1YFKQK6Lg==,type:str] + values.yaml: ENC[AES256_GCM,data:An+GypE/btGmfnvL1rPzvbN1sAnZKQnHV20GxXkZiRb+Wi8BymAUA6JRBo5mdtvK1dgDMF6H1wN+Y7wjzwduteaoskVfgd7Xw+lL1SrZ/6pchGxlUIWSJlLTmp6IHZaruleDUsCKdrWfN9TQDE+WYdiECBktlGGXs8ZZMTzjHmHKJ3tNwSimaxuG662Amb0LiHLX+zBUKOuG0L4cWrp6JI3NKQFgNNiF6xwXjHDX550bGOQ2pi5UVPL9+HlH2tPeTzoCCZdJLWF+2kZg31bZ7dzRp8M23eDrzfGC9e9m0NrA2z1ljagbnuT0tixp6J8205qfBOIOVOWbXHmd/LQ8nphA64En6JXqU8XeZ+mgMUmFuGwyewLq4oilLoQfdZujEyGhc9Hd/yonRlc/RDBlONlI8d+IWqZxf0AaUYEAe9uE6MulqRs0CowPUpCmWtZjz68qQlIvJEAqxNdWEnp+SkExDNNe9y8tBOCXy726TRX0MLIlZ+CjPDCHhwDeKw5oQU0wXr9QezY=,iv:bPK1+PViBg046N3q2Eb1ZOJOYv7X/HgpCEU/MLp7o6k=,tag:/2Kyv7aB4baOL+3KdAeQ9w==,type:str] sops: age: - enc: | @@ -26,6 +26,6 @@ sops: -----END AGE ENCRYPTED FILE----- recipient: age1x4jjwc8nuttwr8us924pvdc6dll5npkc6c8f4zf2hx5d2qu75dtqx0fm0d encrypted_regex: ^(data|stringData)$ - lastmodified: "2026-07-28T19:13:00Z" - mac: ENC[AES256_GCM,data:j4SdYQBtDe9TRssrUvaEk/748P+Lt1fm0r7jeWJhE17jq3WC4czLZt0djefVsdt48gJJdH5Xh3YqRy5Jh7yeFrbbfvzbvUOlsIZxW1AjqTMnSfRN7b7P3uy3FhUEMu0h5hr1DMhLUYnS8DEZESUGPXsenGYMbrIB6j0drjmdWhc=,iv:+2GpjvchggDPEiP9SWnHJhvqjWL6nqMSDoivxDC17ZY=,tag:+ZyWypwpeQXd9aiOUj5BcA==,type:str] + lastmodified: "2026-07-28T19:26:57Z" + mac: ENC[AES256_GCM,data:UfD+QJel9FygoKPM02KdOLvP1id/21ghQ0uWAQJxEs/w+B2vVkpe/dXSJ7QnI0e528ns1HW81GAxkxyAupsUDq8/pBdEQgItwDs5DIgHvH+sTPAtj2Kyq2wMOeEt+XDGLRdOlAwbcKDS/LyfeZ5b9QnAbY2w/tTinTkzEvbudT8=,iv:WmmwjAmZmM0W8dvqBcv9XYZkYtan3lg0Sb8ypVuGoJk=,tag:3yzZhSFtbSbLUXSdDWGAtw==,type:str] version: 3.13.3 -- 2.54.0