From 063c8acf778e1b353aa686d66d53b50cabfcfe71 Mon Sep 17 00:00:00 2001 From: Keith Jackson Date: Sun, 8 Nov 2026 16:05:11 -0600 Subject: [PATCH] chore(cloudflared): rotate tunnel credential (old secret exposed in a transcript) --- platform/cloudflared/cloudflared-credentials.sops.yaml | 6 +++--- platform/cloudflared/config.yaml | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/platform/cloudflared/cloudflared-credentials.sops.yaml b/platform/cloudflared/cloudflared-credentials.sops.yaml index 904e23f..a004412 100644 --- a/platform/cloudflared/cloudflared-credentials.sops.yaml +++ b/platform/cloudflared/cloudflared-credentials.sops.yaml @@ -9,7 +9,7 @@ metadata: namespace: cloudflared type: Opaque stringData: - credentials.json: ENC[AES256_GCM,data:iTCsCQ9g4zouELNa1KzFy8ZO5eLctBdKFaWDXlejpxjWs06sGaduYRPV9kmm1JT8A8s10OevqEEXM+9unOSrmOiUvsxMYAvtwvfyUs3dVbtOB/uCBzHsGK+4cJoC1iII6WzITVe5tlWMXYtyBnDo1Mm3BfO+H/6ytLf750BoABqohO2cfWRfN9MAXL6BFe7urZdKrMou23BooDUxG/pwTpnALbUCer/PhCmrB6cgOw==,iv:ltn/fN59x320pFgvb3/g0UgzBmQcdnnk8JvKpoFn0H0=,tag:fr8s1aDsZBAQYLGXgwG8WA==,type:str] + credentials.json: ENC[AES256_GCM,data:68G438/jsM4KqPt/3wjFp6jVmAVnsidx/FEdK6Lke2euQgkDqRcJjhoKZurapgP8zsP+FrQ98VgsQgUpERHXUCRuJp5wRIgTVmL23CweuZLacaLxBo6eoKmNC/H5DzGZsyhDxGjcXc+8BGpfDFzHR39Uo2h56XstiHtyZhnhlhia8nprLip9RinA9mbKRMJKTR/6IsZsdc91E22aEycDjZ3+nYmr4KP2+km3fd15Nw==,iv:CuAUscGmvMqT2ixFJZVzJWSvDYwbfQl79sQ+FHnXdVQ=,tag:H4fFjXPCFoxE1Mqwx0R5sQ==,type:str] sops: kms: [] gcp_kms: [] @@ -25,8 +25,8 @@ sops: emhHaFpEZWpMN0JXL2NVaW5PU1ZwVW8KkCDX7ED039X12BCmiSqHr0fmZKSZmfjP DIiR6DvWWw1TcB3CjD5q29nIthCDf9zlrpuMfQ+9ODAlRr5t6zP+cg== -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-11-08T21:28:19Z" - mac: ENC[AES256_GCM,data:4wD/6YSBP/e6MTevGSOFTi/EamJRZoryf+aET/opTwjf7yMgi5iObXTnRapKwAFzeXkSkFVfnfRd8Ir714Uez3z2yLxQ6Ygte9VQxHUfkKfXfu+OmuCnjFGaTjsxm6551VPFGHZuto6wZjebwozWuxzHhZi/AjCo2QGyRjmymBM=,iv:hClSAe8r6fhnQzwQY3NZSYhqElzwSRPhI8Y2fH1+r64=,tag:LviWf5oMB6NUjTFNXy62zg==,type:str] + lastmodified: "2026-11-08T22:05:00Z" + mac: ENC[AES256_GCM,data:FaTWQhcdYD4sDu50K9NisBO81cOwHqWKt9b/0XBvZzV5FAMNHBIi4Md3by5XT16paMuS+kgz20/+CLX1PkJ6FNbCwnp7M0+a+xtT+UT67apgJ04B6GW7HZJ+iUS6sOIIFoefSDHfKpO4bYLDIoXWupLYFlbHHRJQqQXpU7yvVgI=,iv:YDSYmgc7YUsYVeh7tPm8Sztvr3+L6xb1lww4lZdzDaY=,tag:7IektWvjJpKG98edUqNadQ==,type:str] pgp: [] encrypted_regex: ^(data|stringData)$ version: 3.9.4 diff --git a/platform/cloudflared/config.yaml b/platform/cloudflared/config.yaml index 27286e4..0334c96 100644 --- a/platform/cloudflared/config.yaml +++ b/platform/cloudflared/config.yaml @@ -20,7 +20,7 @@ # OPERATOR STEP: replace REPLACE-ME-TUNNEL-UUID with the UUID printed by `cloudflared tunnel create` # (runbooks/cloudflare-tunnel.md step 3). Until then cloudflared treats the value as a tunnel NAME, # finds no origin certificate to resolve it with, and exits — a CrashLoop in a non-gating tier. -tunnel: f26f1052-1bc0-4d9d-800b-4da0377472a3 +tunnel: fc81938b-5855-47f1-8a27-6286f56dda93 credentials-file: /etc/cloudflared/creds/credentials.json # Serves /metrics (Prometheus), /ready (200 only with >=1 live edge connection) and /healthcheck. metrics: 0.0.0.0:2000