From ed4b58f0200868e027c1360bf9458977c3dd0f24 Mon Sep 17 00:00:00 2001 From: Your Name Date: Thu, 20 Aug 2026 20:59:59 +0000 Subject: [PATCH] chore(secrets): rotate the Alertmanager webhook topic MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The previous ntfy topic was found in plaintext in a local Claude Code session transcript on the monitoring host while working #11 — one record holding the webhook URL, four holding the MokerLink SNMP community. The transcript was redacted in place, but on the public ntfy.sh instance the topic name *is* the credential: there is no token to revoke and topics cannot be deleted, so the only meaningful response is to move to a new one and stop listening to the old. Rotated to a fresh 32-character topic. Verified end to end: ntfy accepted the publish and the notification arrived on the subscribed device — HTTP 200 alone would only have proven the server took it, not that anyone was listening, which is the failure mode worth ruling out before an outage rather than during one. Ciphertext-only change: ALERTMANAGER_WEBHOOK_URL, plus lastmodified and mac. No reload accompanies this. Alertmanager reads .rendered/webhook_url at notify time rather than at config load, so `make render` alone is sufficient — see the preamble to scripts/reload-config.sh. The five SNMP communities were deliberately not rotated. That exposure never left the host and never reached git, and rotating the switch's community means the `neo` residual in SECURITY.md all over again. Refs #11 --- secrets/observability.sops.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/secrets/observability.sops.yaml b/secrets/observability.sops.yaml index 192d3aa..0efc2e5 100644 --- a/secrets/observability.sops.yaml +++ b/secrets/observability.sops.yaml @@ -27,7 +27,7 @@ SNMP_COMMUNITY_MOKERLINK: ENC[AES256_GCM,data:v+SIe7w9gpQkHYFTiHWB,iv:B4r0MxOESo SNMP_COMMUNITY_ILO: ENC[AES256_GCM,data:RMutxt3mfxMlthO8IQp2wA9x54+SLQuF,iv:fPtLWUwAAojRjX1e7bN6z5f75GNKwy0GTWyr/bFZorM=,tag:18OmJT6h6MiK6UZdwxkfZA==,type:str] #ENC[AES256_GCM,data:KYm60Zx9WHuw0PObbmuV5uOxqGJG51YHztUtmrAPocdqvPmnbSQJthKe3+PngPrfFfn7G8RfRANrDTgboVgQOWbwtvIlhK8CutPr16gq2rM=,iv:elgWymJ/VyQzT63VSPBtWYIsJY26GeG2T4MYZCmInWY=,tag:Px8SEziU2qyNYMMI0B1WAg==,type:comment] #ENC[AES256_GCM,data:c+QE2sE9agdh20ZSaWSTdnENoeFagYWbpy9D7oVKofDsi9oBM8rxxrlp4s8CfB3KcNv7uFBD2SZdMBVDltjfkJICEjKgfJCBQ8A=,iv:PQBt/eUj95BdLusTJc5o3ZwyqIZGy9/XEG/AQTHk/IU=,tag:spc+wLic1oKSlHgvBjiLSg==,type:comment] -ALERTMANAGER_WEBHOOK_URL: ENC[AES256_GCM,data:w1Wf/HOjRiWeEPykftp/E1WU0nTXjyftnHM08eRxTU6asgG09a8TA9XSoIM=,iv:u8eNDX2UThz8F4RxbLTIflV17Na14NGzyaHOP9Xk6bU=,tag:Ufv+P7QT4IoKFUpM+TE5Vg==,type:str] +ALERTMANAGER_WEBHOOK_URL: ENC[AES256_GCM,data:e7vSRxtJxyxmoYpyxFrnNEGwPUosVY03nyLkJTn6+OmJHRZD6g/r06gOA2RcLqJm,iv:7bfgIKZ0rlapBZiTIjoJGCa+GOCACFqk4wtd3lORJFs=,tag:tjegmtIVAydI+I109g8BFw==,type:str] sops: kms: [] gcp_kms: [] @@ -43,8 +43,8 @@ sops: emRhdUUyUGdHMWFlSVE3alNuekp3YTQKAN5Dt+v1PnZlFDZgN2NQ09dGiIfMr1S9 pIUfYyxRjC2qM5prt3Lhfcp0qvvvCsrm857wvxteXNb1jAfGHQoQHQ== -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-08-19T03:55:44Z" - mac: ENC[AES256_GCM,data:QrVdd5IwcTIZix1uLesau/3xImqBh1QCkXL7ZgfFe4zCFSHPg9+Lm32QUCBqCQ7zLhHeJmah3I5Qei7RXVaYuJwsBMiVKQwfVzJbO1MfFJiGZnrLLfG0suyHOG7NC/8LdS7FGo54la/88UmqQmPoxh6heC3ANo3iPeOybX9C3GY=,iv:TgMNN4hLnmur2fWN/NWVR7Zd3+2htZW6lqKFsyAU03o=,tag:P3jbtd9chHxPo2wBcbHEYg==,type:str] + lastmodified: "2026-08-20T20:56:39Z" + mac: ENC[AES256_GCM,data:/IMtc4iNlFSaMNHdc0QEnFJmCKqTCD7zkphtuXee80ylBrydTZxEQTGXZvFurVKIAm3MlC1CWSKcO+nhutD0DrVB60LZrGuKiME2FiK585zEFhhdWZruwN9OtX9vXZFioveaWCiPnVN7xFHO+Y8z+DYepaj+/dsNsAJOx45jHfE=,iv:dzBMCp2FYkft3Ow1oUfbKLWJJ4gwJK4cHxl/waOhDBY=,tag:ePZZ6G6ZboLb2b1iZ/HuBQ==,type:str] pgp: [] unencrypted_suffix: _unencrypted version: 3.9.4