egutierrez
22692c1ed2
Server-side homeserver.yaml on organic-machine VPS: - encryption_enabled_by_default_for_room_type: invite -> all - presence.enabled: false (block EDU metadata leak) - url_preview_enabled: false (block SSRF + IP leak) - msc4108 rendezvous endpoint uncommented (QR login) Synapse restarted, /versions shows e2ee_forced.* + msc4108 unstable features active. Backup at synapse_data/homeserver.yaml.bak.1779659423. Issues opened for remaining gaps: - 0165 LUKS for media_store (at-rest encryption) - 0166 LiveKit TURN deploy (NAT traversal gap) - 0167 STUN leak to Google (hardcode external_ip) - 0168 UDP range expand 200 -> 500 - 0169 LIVEKIT_SECRET rotation (audit exposure) - 0170 livekit.example.yaml rename hygiene Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
61 lines
2.1 KiB
Markdown
61 lines
2.1 KiB
Markdown
---
|
|
id: "0169"
|
|
title: "Rotar LIVEKIT_SECRET (expuesto en sesion auditoria)"
|
|
status: pendiente
|
|
type: bugfix
|
|
domain:
|
|
- matrix
|
|
scope: app:element_matrix_chat
|
|
priority: alta
|
|
depends: []
|
|
blocks: []
|
|
related: []
|
|
created: 2026-05-24
|
|
updated: 2026-05-24
|
|
tags: [matrix, livekit, security, secret-rotation]
|
|
---
|
|
# 0169 — Rotar LIVEKIT_SECRET (expuesto en sesion auditoria)
|
|
|
|
**Status:** pendiente
|
|
**Created:** 2026-05-24
|
|
**Type:** bugfix
|
|
**Priority:** alta
|
|
**Domain:** matrix
|
|
**Scope:** app:element_matrix_chat
|
|
**Depends:** —
|
|
**Blocks:** —
|
|
|
|
## Problema
|
|
|
|
Durante auditoria 2026-05-24 (sesion Claude), `docker inspect element_matrix_chat-livekit-jwt-1` volco `LIVEKIT_SECRET=b00e98f70722bc...` cleartext en stdout de la sesion. Aunque la sesion es del operador, el secret quedo en log de conversacion + potencialmente en backups del log + transcripts. Rotacion necesaria por higiene.
|
|
|
|
## Objetivo
|
|
|
|
Nuevo secret 32 bytes hex, mismo `api_key` (o regenerar ambos), stack restart sin perdida sesion.
|
|
|
|
## Plan
|
|
|
|
1. Generar nuevo secret: `openssl rand -hex 32`.
|
|
2. Editar `configs/livekit/livekit.yaml` → bloque `keys:` con nuevo valor.
|
|
3. Editar `.env` de docker-compose (var `LIVEKIT_SECRET` consumida por `livekit-jwt`).
|
|
4. Restart `element_matrix_chat-livekit-1` y `element_matrix_chat-livekit-jwt-1` en orden.
|
|
5. Test call Element Call → handshake JWT OK.
|
|
6. Guardar secret antiguo + nuevo en `pass` con timestamp rotacion.
|
|
|
|
## Acceptance
|
|
|
|
- [ ] `docker inspect ... --format "{{.Config.Env}}"` muestra secret nuevo.
|
|
- [ ] Element Call inicia call sin error "invalid token".
|
|
- [ ] Entry `pass matrix/livekit-secret` actualizada.
|
|
|
|
## Definition of Done
|
|
|
|
- [ ] Repetibilidad: rotacion documentada como funcion del registry (candidato `livekit_secret_rotate_bash_infra`).
|
|
- [ ] Observabilidad: rotation log con timestamp.
|
|
|
|
## Notas
|
|
|
|
Considerar promover el procedimiento a funcion del registry: `livekit_secret_rotate_bash_infra(ssh_host, compose_dir)` que automatiza pasos 1-5 y guarda en pass via `gpg_pass_write`.
|
|
|
|
Patron similar para otros secrets del stack (Synapse macaroon, MAS encryption key, postgres passwords) → capability group nuevo `secret-rotation`.
|