scripts/rotate-session-secret.sh mints a fresh SESSION_SECRET and pushes it to every prod worker (apex + all versioned hosts) plus the write-only TRIBES_SESSION_SECRET GH secret in one pass, never printing the value. Needed because all hosts share the .tribes.pub cookie domain: a cookie minted on the apex must verify on every versioned host, so the secret must rotate everywhere at once. Cost: one forced re-login.
- commit
- 4c3b1aec30069674df81ace2782795f439ae0d27
- parent
- 51b177b957b78737fcf638cdbf0e04ac8e88484e
- author
- Dami <dami.etoile@gmail.com>
| A | scripts/ | 32 | ++++++++++++++++++++++++++++++ |
@@ -0,0 +1,32 @@
1+2+# Rotate SESSION_SECRET across every prod worker: scripts/rotate-session-secret.sh3+#4+# All hosts on the shared .tribes.pub cookie domain must hold the SAME secret5+# (a session cookie minted on the apex must verify on every versioned host).6+# Rotation therefore pushes one fresh value everywhere at once, plus the GH7+# secret TRIBES_SESSION_SECRET (write-only mirror used by release.sh runs).8+# Cost of rotation: every live session cookie stops verifying — users simply9+# log in again (shoo link or device keypair re-mint). The value is never10+# printed, stored on disk, or exported beyond this process.11+set -euo pipefail12+cd "$(dirname "$0")/.."13+14+WORKERS=(tribes-prod tribes-v0-4-0 tribes-v0-3-1 tribes-v0-3-0 tribes-v0-2-0 tribes-v0-1-0)15+16+SECRET="$(openssl rand -hex 32)"17+18+for w in "${WORKERS[@]}"; do19+ if printf '%s' "$SECRET" | npx wrangler secret put SESSION_SECRET --name "$w" >/dev/null 2>&1; then20+ echo "ok $w"21+ else22+ echo "skip $w (worker missing or put failed)"23+ fi24+done25+26+if command -v gh >/dev/null && printf '%s' "$SECRET" | gh secret set TRIBES_SESSION_SECRET --repo FelineStateMachine/tribes 2>/dev/null; then27+ echo "ok gh secret TRIBES_SESSION_SECRET"28+else29+ echo "skip gh secret (gh missing or set failed)"30+fi31+32+echo "done: rotated SESSION_SECRET on the workers marked ok; existing sessions are now logged out"