root
8fc88ffc14
Build & Push / Pipeline Tests (push) Failing after 59s
Build & Push / Build & Push Docker Image (push) Has been skipped
Test / Type Check (all packages) (push) Failing after 51s
Test / API Unit Tests (push) Has been skipped
Test / Homepage Unit Tests (push) Has been skipped
Test / Carplace Unit Tests (push) Has been skipped
Test / Admin Unit Tests (push) Has been skipped
Test / Dashboard Unit Tests (push) Has been skipped
Test / API Integration Tests (push) Has been skipped
46 lines
1.4 KiB
Markdown
46 lines
1.4 KiB
Markdown
# Key rotation drill (Phase 3)
|
|
|
|
**Status:** Ops runbook
|
|
**Date:** 2026-08-12
|
|
|
|
## Secrets in scope
|
|
|
|
| Secret | Used by | Rotation impact |
|
|
|--------|---------|-----------------|
|
|
| `JWT_SECRET` | API token signing | Invalidates existing employee/admin/renter sessions |
|
|
| Company API keys | Partner/Carplace integrations | Per-company reissue via admin/API |
|
|
| Payment provider webhooks | Stripe/PayPal/AmanPay | Update dashboard + env together |
|
|
| DB / Redis passwords | Compose / managed services | Coordinated restart |
|
|
| Object storage keys | S3/MinIO driver | Dual-key period preferred |
|
|
|
|
## JWT_SECRET drill (staging)
|
|
|
|
1. Announce maintenance window (sessions will drop).
|
|
2. Generate a new high-entropy secret; store in secret manager **before** env change.
|
|
3. Update staging `.env` / secret store; rolling-restart API + worker.
|
|
4. Confirm:
|
|
- Old bearer tokens return 401
|
|
- Fresh login issues valid tokens
|
|
- `/ready` stays healthy
|
|
5. Record time-to-rotate and any customer-facing impact.
|
|
|
|
## Company API key drill
|
|
|
|
1. Create a replacement key for a test company.
|
|
2. Switch the client to the new key.
|
|
3. Revoke/disable the old key.
|
|
4. Confirm old key fails; new key succeeds.
|
|
|
|
## Evidence
|
|
|
|
| Field | Value |
|
|
|-------|-------|
|
|
| Date | |
|
|
| Environment | staging |
|
|
| Secrets rotated | |
|
|
| Duration | |
|
|
| Issues | |
|
|
| Operator | |
|
|
|
|
Do **not** rotate production secrets without dual-control and a tested rollback path for webhook signing secrets.
|