chore(secrets): rotate the Alertmanager webhook topic - #45
Merged
Conversation
The previous ntfy topic was found in plaintext in a local Claude Code session transcript on the monitoring host while working #11 — one record holding the webhook URL, four holding the MokerLink SNMP community. The transcript was redacted in place, but on the public ntfy.sh instance the topic name *is* the credential: there is no token to revoke and topics cannot be deleted, so the only meaningful response is to move to a new one and stop listening to the old. Rotated to a fresh 32-character topic. Verified end to end: ntfy accepted the publish and the notification arrived on the subscribed device — HTTP 200 alone would only have proven the server took it, not that anyone was listening, which is the failure mode worth ruling out before an outage rather than during one. Ciphertext-only change: ALERTMANAGER_WEBHOOK_URL, plus lastmodified and mac. No reload accompanies this. Alertmanager reads .rendered/webhook_url at notify time rather than at config load, so `make render` alone is sufficient — see the preamble to scripts/reload-config.sh. The five SNMP communities were deliberately not rotated. That exposure never left the host and never reached git, and rotating the switch's community means the `neo` residual in SECURITY.md all over again. Refs #11
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-on from #11 and #41.
The previous ntfy topic was found in plaintext in a local Claude Code session transcript on the monitoring host. The transcript was redacted in place — but on public ntfy.sh the topic name is the credential. There is no token to revoke and topics cannot be deleted, so the only meaningful response is to move to a new topic and stop listening to the old one. Anyone who had the old one can still publish to it; nothing will be subscribed.
Rotated to a fresh 32-character topic.
Verification
make renderrewrote.rendered/webhook_url(mode 600, gitignored); confirmed in sync with the sops valuemake secrets-editand left zero entries in~/.local/state/nvim/undodir/. The same action created one before fix(secrets): stop the editor keeping a decrypted copy of the secrets #41ALERTMANAGER_WEBHOOK_URL,lastmodified,mac; 26 encrypted fields intact, no plaintext URL in the tracked fileNot in scope
No reload — Alertmanager reads
url_fileat notify time, not at config load (scripts/reload-config.shpreamble).The five SNMP communities were not rotated. That exposure never left the host and never reached git, and rotating the switch's community reruns the
neoresidual inSECURITY.md.Refs #11
🤖 Generated with Claude Code