Thore CimbalandClaude Sonnet 5
0242238597
Auto-Deploy on Push / verify-and-notify (push) Canceled after 0s
Issue #38 discussion surfaced a real bug: the TURN shared secret was duplicated - correctly SOPS-encrypted in coturn-secret.yaml, but also hardcoded in plaintext in synapse-values.yaml (a plain, non-SOPS ConfigMap), visible in git history. Also found turn_user_lifetime is 86400000ms (24h), not "short-lived" as previously assumed - raising the stakes of the leak somewhat. Extracted the turn config block into its own dedicated SOPS-encrypted Secret (synapse-turn-secret.yaml), wired via a second HelmRelease valuesFrom entry (same pattern already used for ess-mas-values-secret). Rotated the value while doing this, so the leaked plaintext secret is no longer live anywhere. Added checksum/rotated-at annotations (matrix-stack HelmRelease's existing element-config-checksum patch gets a sibling turn-secret-checksum; coturn's Deployment pod template gets a rotated-at annotation) so future rotations actually restart both consumers - Kubernetes doesn't restart running pods when a referenced Secret's content changes on its own. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
42 lines
1.5 KiB
YAML
42 lines
1.5 KiB
YAML
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
|
|
# Patch: Fügt Checksums der element-values.yaml und des turn_shared_secret zur
|
|
# HelmRelease hinzu. Damit wird Flux die HelmRelease neu-synced (und synapse-main neu
|
|
# gestartet), wenn sich die jeweilige ConfigMap/Secret ändert - siehe Issue #38's
|
|
# Rotations-Mechanismus, der turn-secret-checksum bei jeder Rotation bumpt.
|
|
patches:
|
|
- target:
|
|
kind: HelmRelease
|
|
name: matrix-stack
|
|
namespace: matrix
|
|
patch: |-
|
|
- op: add
|
|
path: /metadata/annotations/element-config-checksum
|
|
value: "401f8a87d0ef5d91d2e5032d4aede42c"
|
|
- op: add
|
|
path: /metadata/annotations/turn-secret-checksum
|
|
value: "9b0383df36943da3b32198b6bd32bfcd"
|
|
|
|
resources:
|
|
- matrix-postgres-auth.yaml
|
|
- cert-issuer.yaml
|
|
- matrix-certificates.yaml
|
|
# Neue Dateien:
|
|
- custom-configs/synapse-values.yaml
|
|
- custom-configs/element-values.yaml
|
|
- custom-configs/mas-secret.yaml
|
|
- element-web-docs-configmap.yaml
|
|
- element-web-docs-server.yaml
|
|
# TURN Server für WebRTC
|
|
- coturn-secret.yaml
|
|
- coturn.yaml
|
|
- synapse-turn-secret.yaml
|
|
# HelmRelease (muss ganz unten stehen, damit die ConfigMaps vorher da sind!)
|
|
- element-server-suite.yaml
|
|
# Custom Apex Ingress für Element Web + Well-Known auf axion1337.chat
|
|
- apex-ingress.yaml # Custom Apex Ingress für Element Web + Well-Known auf axion1337.chat
|
|
- networkpolicy.yaml
|
|
# Backup zur Hetzner Storage Box (Issues #6 + #15)
|
|
- synapse-backup-secret.yaml
|
|
- synapse-backup.yaml |