Rotate service credentials and encryption keys #23

New issue

Open

opened 2026-07-14 22:32:27 -04:00 by caleb-brown · 0 comments

caleb-brown commented

2026-07-14 22:32:27 -04:00

Owner

What to build

Temper Operators can rotate Forgejo, provider, webhook, and encryption credentials safely, verify the replacement, and recover from mistakes without exposing secret material.

Acceptance criteria

PAT and provider-credential replacement verifies the new credential before retiring the old encrypted value.
Webhook-secret rotation provides a safe transition and clearly coordinates the required Forgejo change.
Credential encryption uses an active-plus-previous keyring so stored secrets can be rewrapped without a flag day.
Session-signing and credential-encryption keys remain separate through rotation.
Interrupted or failed rotation leaves the Deployment in a recoverable, clearly reported state.
Rotation actions and outcomes are audited without recording secret values or sensitive headers.
Tests cover successful, interrupted, invalid, rollback, and previous-key decryption scenarios.

Blocked by

#10 — Configure and verify the model provider
#11 — Connect and verify a Forgejo service identity
#22 — Manage Temper Operators and sessions

## What to build Temper Operators can rotate Forgejo, provider, webhook, and encryption credentials safely, verify the replacement, and recover from mistakes without exposing secret material. ## Acceptance criteria - [ ] PAT and provider-credential replacement verifies the new credential before retiring the old encrypted value. - [ ] Webhook-secret rotation provides a safe transition and clearly coordinates the required Forgejo change. - [ ] Credential encryption uses an active-plus-previous keyring so stored secrets can be rewrapped without a flag day. - [ ] Session-signing and credential-encryption keys remain separate through rotation. - [ ] Interrupted or failed rotation leaves the Deployment in a recoverable, clearly reported state. - [ ] Rotation actions and outcomes are audited without recording secret values or sensitive headers. - [ ] Tests cover successful, interrupted, invalid, rollback, and previous-key decryption scenarios. ## Blocked by - [#10](https://git.caleb-brown.dev/caleb-brown/temper/issues/10) — Configure and verify the model provider - [#11](https://git.caleb-brown.dev/caleb-brown/temper/issues/11) — Connect and verify a Forgejo service identity - [#22](https://git.caleb-brown.dev/caleb-brown/temper/issues/22) — Manage Temper Operators and sessions

caleb-brown added the

ready-for-agent

label

2026-07-14 22:32:27 -04:00

caleb-brown referenced this issue

2026-07-14 22:32:28 -04:00

Pause, disconnect, uninstall, and purge repositories #24

caleb-brown referenced this issue

2026-07-14 22:32:31 -04:00

Package a recoverable production release #27

caleb-brown added a new dependency

2026-07-14 22:38:25 -04:00