Files

T

egutierrez 22692c1ed2 feat(matrix): 4 synapse quick wins applied + 6 follow-up issues

Server-side homeserver.yaml on organic-machine VPS:
- encryption_enabled_by_default_for_room_type: invite -> all
- presence.enabled: false (block EDU metadata leak)
- url_preview_enabled: false (block SSRF + IP leak)
- msc4108 rendezvous endpoint uncommented (QR login)

Synapse restarted, /versions shows e2ee_forced.* + msc4108 unstable
features active. Backup at synapse_data/homeserver.yaml.bak.1779659423.

Issues opened for remaining gaps:
- 0165 LUKS for media_store (at-rest encryption)
- 0166 LiveKit TURN deploy (NAT traversal gap)
- 0167 STUN leak to Google (hardcode external_ip)
- 0168 UDP range expand 200 -> 500
- 0169 LIVEKIT_SECRET rotation (audit exposure)
- 0170 livekit.example.yaml rename hygiene

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-24 23:53:37 +02:00

2.1 KiB

Raw Blame History

id, title, status, type, domain, scope, priority, depends, blocks, related, created, updated, tags

title

status

type

domain

scope

priority

depends

blocks

created

updated

0169 — Rotar LIVEKIT_SECRET (expuesto en sesion auditoria)

Status: pendiente Created: 2026-05-24 Type: bugfix Priority: alta Domain: matrix Scope: app:element_matrix_chat Depends: — Blocks: —

Problema

Durante auditoria 2026-05-24 (sesion Claude), docker inspect element_matrix_chat-livekit-jwt-1 volco LIVEKIT_SECRET=b00e98f70722bc... cleartext en stdout de la sesion. Aunque la sesion es del operador, el secret quedo en log de conversacion + potencialmente en backups del log + transcripts. Rotacion necesaria por higiene.

Objetivo

Nuevo secret 32 bytes hex, mismo api_key (o regenerar ambos), stack restart sin perdida sesion.

Plan

Generar nuevo secret: openssl rand -hex 32.
Editar configs/livekit/livekit.yaml → bloque keys: con nuevo valor.
Editar .env de docker-compose (var LIVEKIT_SECRET consumida por livekit-jwt).
Restart element_matrix_chat-livekit-1 y element_matrix_chat-livekit-jwt-1 en orden.
Test call Element Call → handshake JWT OK.
Guardar secret antiguo + nuevo en pass con timestamp rotacion.

Acceptance

docker inspect ... --format "{{.Config.Env}}" muestra secret nuevo.
Element Call inicia call sin error "invalid token".
Entry pass matrix/livekit-secret actualizada.

Definition of Done

Repetibilidad: rotacion documentada como funcion del registry (candidato livekit_secret_rotate_bash_infra).
Observabilidad: rotation log con timestamp.

Notas

Considerar promover el procedimiento a funcion del registry: livekit_secret_rotate_bash_infra(ssh_host, compose_dir) que automatiza pasos 1-5 y guarda en pass via gpg_pass_write.

Patron similar para otros secrets del stack (Synapse macaroon, MAS encryption key, postgres passwords) → capability group nuevo secret-rotation.

2.1 KiB Raw Blame History