sorb/axion1337.chat-gitops
1
0
Fork 0
Code Issues Pull Requests Packages Projects 1 Releases 24 Wiki Activity

chore(coturn): automated TURN shared-secret rotation #46

Closed
sorb wants to merge 76 commits from turn-secret-rotation-20260801-020001 into main
pull from: turn-secret-rotation-20260801-020001
merge into: :main
Conversation 1 Commits 76 Files Changed 61
+9 -9
4 changed files with 9 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit ee91f121b8 - Show all commits
apps/production/coturn-secret.yaml
+3 -3
View File
@@ -4,7 +4,7 @@ metadata:
name: coturn-secret
namespace: matrix
stringData:
TURN_SECRET: ENC[AES256_GCM,data:ZLp9/NqMZ+nrU8hUdwKndBjBh6Qa94O3UUuT71E8XDt5mP6+uZeVab27IqssqNJ6+T9tuj5uw5Q9Pj3NK6rERw==,iv:t4nvWH4rqWDHDzYOrrESwwtqMQ6YJ2CQzVbcyaYiaYM=,tag:5/LDvbVVj+a5TLjLBci1Dw==,type:str]
TURN_SECRET: ENC[AES256_GCM,data:gab4MSNlRANQz/T/Xn0Z45tkUvQ3Uxn5u0MyYfhZTan49P865UbX4rYPf/KmKsekdwFdOGBzvCgcwxhddVbZ1w==,iv:INbz5UUxgA6xdsPBp5W9Mwe+kd9dhHh2Rx5l3yeNRIQ=,tag:dgk/iFjvst7Wul9Lai2QEQ==,type:str]
sops:
age:
- enc: |
@@ -26,6 +26,6 @@ sops:
-----END AGE ENCRYPTED FILE-----
recipient: age1x4jjwc8nuttwr8us924pvdc6dll5npkc6c8f4zf2hx5d2qu75dtqx0fm0d
encrypted_regex: ^(data|stringData)$
lastmodified: "2026-07-28T19:13:00Z"
mac: ENC[AES256_GCM,data:i2dEOiO1K1RNoGgkJyZf7eGix0yaqSwbeE1NOQf72alyA8bM8p5ufz6X2P49OUmw2d8vjsJ40sTTSUcnI2/ZoeFJ24jEN7N6pVj2Wy9DkBynIlnPWvVxa347T6/yToPp3neLreH1ap+I50FUcnK50hS+TpRHtSW+9Js5oxrJxTQ=,iv:yFmrcDr2gW1EJRNSSQ8Ie3PXS4bNFqiK5Bbvy6IGlHE=,tag:G1vn8StyJFpl+duZHb0vPg==,type:str]
lastmodified: "2026-07-28T19:26:57Z"
mac: ENC[AES256_GCM,data:zU3i1WGY1X4igBYzfC1WAWdtMQZWGBSacaJpXnUVt6+BCfucqaH807IRWpWbTR0+xuLteaqcdXuVuAlStqs/VV586Q4cD2FfWDeBq/O09HEwTrfekTjAyyu7zCFyZ2ja+kB4DQ83NoscCiNwNmfTZF+6RzMqx7yphPxK5go1r7c=,iv:6FIYWsNvz78zJscbxyDgy1u6ur20MnOMkMcsA4329OI=,tag:uSDpAWEixGcVmtOloMoKuw==,type:str]
version: 3.12.2
apps/production/coturn.yaml
+1 -1
View File
@@ -88,7 +88,7 @@ spec:
# Bumped on every TURN_SECRET rotation (Issue #38) to force a new pod, since
# Kubernetes doesn't restart running pods when a referenced Secret's content
# changes and the initContainer that reads it only runs once at pod start.
rotated-at: "2026-07-28T19:02:00Z"
rotated-at: "2026-07-28T19:26:57Z"
spec:
hostNetwork: true
dnsPolicy: ClusterFirstWithHostNet
apps/production/kustomization.yaml
+2 -2
View File
@@ -16,7 +16,7 @@ patches:
value: "401f8a87d0ef5d91d2e5032d4aede42c"
- op: add
path: /metadata/annotations/turn-secret-checksum
value: "9b0383df36943da3b32198b6bd32bfcd"
value: "d220c0e4ff8f7106328c8827d47e8734"
resources:
- matrix-postgres-auth.yaml
@@ -42,4 +42,4 @@ resources:
- synapse-backup.yaml
# Automatisierte TURN-Secret-Rotation (Issue #38)
- turn-secret-rotation-secret.yaml
- turn-secret-rotation.yaml
- turn-secret-rotation.yaml
apps/production/synapse-turn-secret.yaml
+3 -3
View File
@@ -4,7 +4,7 @@ metadata:
name: synapse-turn-secret
namespace: matrix
stringData:
values.yaml: ENC[AES256_GCM,data:/i/7U40uJ11Zl5/882qWzyWOI0sdzGdyvPrvImM6xULCb3t91D2sXLJK19DMnG5b2XARgN/PDmXhK/yux8OZzj3pDac8dNvgrhqL7peAuf61TWUtqmse+6V5P5ajaeVuWnbsSSrTZKg6HZY0Olzd34qsMSwmFp5FPcROSfPwxMuTqHG1OBaRzcIiIEna6rGZ8jItsqimDa0ce6nZ16t0nRFlhHVGMKZxc8Ctb56W2TRmyk8mh3VArhA/PI+tMwFKwUy00Gotywd6wvug0dgRk+EcHJrSCyDQQvTgLFzHlhbB2hZs5zRyCNc4ipvSJtMl1gG5I+rDabFIz6+4/f0wHyuCED0Tr4TMWwibbHBOy1xObS8Dk7eBMDxNykhCKriHdNgGimzyutOGfqm6EVRY6+22aHAzEkMNaaN4zfSkVIbmGl5TMsaRhdZGb1vSfkToLAJPxk9Tpjer/5DJ7dui2b0HkqJ1oAUDdpXzgm05mn7CW/LN7JwzBo2IOn1izzCK5OU4KrzqPJFz,iv:+DYUBkJC8FZIl+mXc5NWv1EfSRWq+ho1huwTerFhZwM=,tag:HoSC13tQzd8GT1YFKQK6Lg==,type:str]
values.yaml: ENC[AES256_GCM,data:An+GypE/btGmfnvL1rPzvbN1sAnZKQnHV20GxXkZiRb+Wi8BymAUA6JRBo5mdtvK1dgDMF6H1wN+Y7wjzwduteaoskVfgd7Xw+lL1SrZ/6pchGxlUIWSJlLTmp6IHZaruleDUsCKdrWfN9TQDE+WYdiECBktlGGXs8ZZMTzjHmHKJ3tNwSimaxuG662Amb0LiHLX+zBUKOuG0L4cWrp6JI3NKQFgNNiF6xwXjHDX550bGOQ2pi5UVPL9+HlH2tPeTzoCCZdJLWF+2kZg31bZ7dzRp8M23eDrzfGC9e9m0NrA2z1ljagbnuT0tixp6J8205qfBOIOVOWbXHmd/LQ8nphA64En6JXqU8XeZ+mgMUmFuGwyewLq4oilLoQfdZujEyGhc9Hd/yonRlc/RDBlONlI8d+IWqZxf0AaUYEAe9uE6MulqRs0CowPUpCmWtZjz68qQlIvJEAqxNdWEnp+SkExDNNe9y8tBOCXy726TRX0MLIlZ+CjPDCHhwDeKw5oQU0wXr9QezY=,iv:bPK1+PViBg046N3q2Eb1ZOJOYv7X/HgpCEU/MLp7o6k=,tag:/2Kyv7aB4baOL+3KdAeQ9w==,type:str]
sops:
age:
- enc: |
@@ -26,6 +26,6 @@ sops:
-----END AGE ENCRYPTED FILE-----
recipient: age1x4jjwc8nuttwr8us924pvdc6dll5npkc6c8f4zf2hx5d2qu75dtqx0fm0d
encrypted_regex: ^(data|stringData)$
lastmodified: "2026-07-28T19:13:00Z"
mac: ENC[AES256_GCM,data:j4SdYQBtDe9TRssrUvaEk/748P+Lt1fm0r7jeWJhE17jq3WC4czLZt0djefVsdt48gJJdH5Xh3YqRy5Jh7yeFrbbfvzbvUOlsIZxW1AjqTMnSfRN7b7P3uy3FhUEMu0h5hr1DMhLUYnS8DEZESUGPXsenGYMbrIB6j0drjmdWhc=,iv:+2GpjvchggDPEiP9SWnHJhvqjWL6nqMSDoivxDC17ZY=,tag:+ZyWypwpeQXd9aiOUj5BcA==,type:str]
lastmodified: "2026-07-28T19:26:57Z"
mac: ENC[AES256_GCM,data:UfD+QJel9FygoKPM02KdOLvP1id/21ghQ0uWAQJxEs/w+B2vVkpe/dXSJ7QnI0e528ns1HW81GAxkxyAupsUDq8/pBdEQgItwDs5DIgHvH+sTPAtj2Kyq2wMOeEt+XDGLRdOlAwbcKDS/LyfeZ5b9QnAbY2w/tTinTkzEvbudT8=,iv:WmmwjAmZmM0W8dvqBcv9XYZkYtan3lg0Sb8ypVuGoJk=,tag:3yzZhSFtbSbLUXSdDWGAtw==,type:str]
version: 3.13.3