root
fe8ffbeb9f
Build & Push / Pipeline Tests (push) Failing after 59s
Build & Push / Build & Push Docker Image (push) Has been skipped
Test / Type Check (all packages) (push) Failing after 48s
Test / API Unit Tests (push) Has been skipped
Test / Homepage Unit Tests (push) Has been skipped
Test / Carplace Unit Tests (push) Has been skipped
Test / Admin Unit Tests (push) Has been skipped
Test / Dashboard Unit Tests (push) Has been skipped
Test / API Integration Tests (push) Has been skipped
1.3 KiB
1.3 KiB
Key rotation drill (Phase 3)
Status: Ops runbook
Date: 2026-08-12
Secrets in scope
| Secret | Used by | Rotation impact |
|---|---|---|
JWT_SECRET |
API token signing | Invalidates existing employee/admin/renter sessions |
| Company API keys | Partner/Carplace integrations | Per-company reissue via admin/API |
| DB / Redis passwords | Compose / managed services | Coordinated restart |
| Object storage keys | S3/MinIO driver | Dual-key period preferred |
JWT_SECRET drill (staging)
- Announce maintenance window (sessions will drop).
- Generate a new high-entropy secret; store in secret manager before env change.
- Update staging
.env/ secret store; rolling-restart API + worker. - Confirm:
- Old bearer tokens return 401
- Fresh login issues valid tokens
/readystays healthy
- Record time-to-rotate and any customer-facing impact.
Company API key drill
- Create a replacement key for a test company.
- Switch the client to the new key.
- Revoke/disable the old key.
- Confirm old key fails; new key succeeds.
Evidence
| Field | Value |
|---|---|
| Date | |
| Environment | staging |
| Secrets rotated | |
| Duration | |
| Issues | |
| Operator |
Do not rotate production secrets without dual-control and a tested rollback path for webhook signing secrets.