6f5550dc50
Introduces a dedicated ENCRYPTION_KEY for encrypting stored secrets (API keys, MFA TOTP, SMTP password, OIDC client secret) so that rotating the JWT signing secret no longer invalidates encrypted data, and a compromised JWT_SECRET no longer exposes stored credentials. - server/src/config.ts: add ENCRYPTION_KEY (auto-generated to data/.encryption_key if not set, same pattern as JWT_SECRET); switch JWT_SECRET to `export let` so updateJwtSecret() keeps the CJS module binding live for all importers without restart - apiKeyCrypto.ts, mfaCrypto.ts: derive encryption keys from ENCRYPTION_KEY instead of JWT_SECRET - admin POST /rotate-jwt-secret: generates a new 32-byte hex secret, persists it to data/.jwt_secret, updates the live in-process binding via updateJwtSecret(), and writes an audit log entry - Admin panel (Settings → Danger Zone): "Rotate JWT Secret" button with a confirmation modal warning that all sessions will be invalidated; on success the acting admin is logged out immediately - docker-compose.yml, .env.example, README, Helm chart (values.yaml, secret.yaml, deployment.yaml, NOTES.txt, README): document ENCRYPTION_KEY and its upgrade migration path
33 lines
1.2 KiB
YAML
33 lines
1.2 KiB
YAML
{{- if and (not .Values.existingSecret) (not .Values.generateJwtSecret) }}
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: {{ include "trek.fullname" . }}-secret
|
|
labels:
|
|
app: {{ include "trek.name" . }}
|
|
type: Opaque
|
|
data:
|
|
{{ .Values.existingSecretKey | default "JWT_SECRET" }}: {{ .Values.secretEnv.JWT_SECRET | b64enc | quote }}
|
|
ENCRYPTION_KEY: {{ .Values.secretEnv.ENCRYPTION_KEY | b64enc | quote }}
|
|
{{- end }}
|
|
|
|
{{- if and (not .Values.existingSecret) (.Values.generateJwtSecret) }}
|
|
{{- $secretName := printf "%s-secret" (include "trek.fullname" .) }}
|
|
{{- $existingSecret := (lookup "v1" "Secret" .Release.Namespace $secretName) }}
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: {{ $secretName }}
|
|
labels:
|
|
app: {{ include "trek.name" . }}
|
|
type: Opaque
|
|
stringData:
|
|
{{- if and $existingSecret $existingSecret.data }}
|
|
{{ .Values.existingSecretKey | default "JWT_SECRET" }}: {{ index $existingSecret.data (.Values.existingSecretKey | default "JWT_SECRET") | b64dec }}
|
|
ENCRYPTION_KEY: {{ index $existingSecret.data "ENCRYPTION_KEY" | b64dec }}
|
|
{{- else }}
|
|
{{ .Values.existingSecretKey | default "JWT_SECRET" }}: {{ randAlphaNum 32 }}
|
|
ENCRYPTION_KEY: {{ randAlphaNum 32 }}
|
|
{{- end }}
|
|
{{- end }}
|