docs(2.7): downgrade on measurement; fix a recovery path that pointed at nothing - #575
Merged
Merged
Conversation
… at nothing The entry read 'offline-crackable, and the only credential for those clients'. Both halves are wrong, and it was ranked Tier 1 on that basis earlier the same day. Not offline-crackable: the committed values are argon2id hashes at m=65536,t=3,p=4 over 256-bit random plaintexts. Measured by length without reading any value -- four at len=64 (openssl rand -hex 32) and grafana at len=44 (openssl rand -base64 32). minio/externalsecret.yaml documents the command. Not the only credential either: the plaintexts are in Vault under access control and the committed value is the digest. Storing the hash in config is Authelia's documented design. Not migrating them: moving the hashes into Vault needs Authelia's config-templating filter, which adds a dependency and a failure mode where a templating mistake breaks SSO -- including access to Grafana and ArgoCD, the tools you would use to diagnose it. Real cost, no meaningful gain. The one real defect, found while checking: authelia/external-secret.yaml said the immich plaintext lives at secret/lab/authelia/immich_client_secret. It has never been there -- that path holds seven keys and this is not one. The secret is at secret/lab/immich -> oidc-client-secret, following the same convention as the other four. That comment is a recovery instruction, so anyone needing to re-enter the secret would have checked the documented path, found nothing, and reasonably concluded the credential was lost. Corrected, with all five paths and measured lengths recorded in one place. Immich having no ExternalSecret for its OIDC secret is correct rather than an omission: it keeps OIDC settings in its own Postgres via the admin UI, so there is no k8s Secret for ESO to populate. The plaintext exists in Vault and in the Immich database, which is backed up nightly.
Uh oh!
There was an error while loading. Please reload this page.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The entry read 'offline-crackable, and the only credential for those clients'. Both halves are wrong, and it was ranked Tier 1 on that basis earlier the same day.
Not offline-crackable: the committed values are argon2id hashes at m=65536,t=3,p=4 over 256-bit random plaintexts. Measured by length without reading any value -- four at len=64 (openssl rand -hex 32) and grafana at len=44 (openssl rand -base64 32). minio/externalsecret.yaml documents the command. Not the only credential either: the plaintexts are in Vault under access control and the committed value is the digest. Storing the hash in config is Authelia's documented design.
Not migrating them: moving the hashes into Vault needs Authelia's config-templating filter, which adds a dependency and a failure mode where a templating mistake breaks SSO -- including access to Grafana and ArgoCD, the tools you would use to diagnose it. Real cost, no meaningful gain.
The one real defect, found while checking: authelia/external-secret.yaml said the immich plaintext lives at secret/lab/authelia/immich_client_secret. It has never been there -- that path holds seven keys and this is not one. The secret is at secret/lab/immich -> oidc-client-secret, following the same convention as the other four. That comment is a recovery instruction, so anyone needing to re-enter the secret would have checked the documented path, found nothing, and reasonably concluded the credential was lost. Corrected, with all five paths and measured lengths recorded in one place.
Immich having no ExternalSecret for its OIDC secret is correct rather than an omission: it keeps OIDC settings in its own Postgres via the admin UI, so there is no k8s Secret for ESO to populate. The plaintext exists in Vault and in the Immich database, which is backed up nightly.