security(alertmanager): add token rotation runbook (HOM-182) #323
Open
aaron
wants to merge 1 commit from
security/HOM-182-alertmanager-token-rotation-runbook into live
pull from: security/HOM-182-alertmanager-token-rotation-runbook
merge into: aaron:live
aaron:main
aaron:chore/zitadel-oidc-rotate-outline
aaron:live
aaron:HOMELAB-1416-ci-runner-resilience
aaron:HOMELAB-1416-verify
aaron:plane/HOMELAB-1405-tailscale-saas
aaron:plane/HOMELAB-1402-headscale-runbook
aaron:fix/HOMELAB-1398-hostname-config
aaron:feat/cp-per-node-overrides
aaron:feat/HOM-582-talos-cp-operations
aaron:feat/HOM-530-etcd-control-plane-monitor
aaron:feat/HOM-530-control-plane-health-monitor
aaron:HOM-521-rename-https
aaron:HOM-521-plane-refresh
aaron:HOM-521-dummy-listener
aaron:HOM-521-refresh-gateway
aaron:security/HOM-519-deep-research-key-split
aaron:HOM-502-worker-disk-tuning
aaron:fix/media-network-policies
aaron:plane/HOMELAB-1343-external-snapshotter
aaron:fix/media-recreate-strategy
aaron:plane/HOMELAB-1338-media-integration
aaron:fix/HOM-481-etcd-io
aaron:security/HOM-102-models-json-no-log
aaron:fix/HOM-102-home-mode
aaron:plane/HOMELAB-1339-longhorn-csi-alerts
aaron:feat/HOM-102-deep-research-infra
aaron:plane/HOMELAB-1330-ci-lint
aaron:fix/HOM-474-navidrome-migration-ttl
aaron:fix/HOM-474-ttl-migration-jobs
aaron:feat/HOM-451-jellyfin-longhorn-config-v2
aaron:paperclip/HOM-447-radarr-config-longhorn
aaron:paperclip/HOM-445-prowlarr-longhorn
aaron:feat/HOM-450-navidrome-longhorn-config
aaron:paperclip/HOM-448-bazarr-config-longhorn
aaron:paperclip/HOM-446-lidarr-config-longhorn
aaron:fix/media-probe-timeouts
aaron:plane/HOMELAB-1327-docs
aaron:plane/HOMELAB-1327-server-url
aaron:plane/HOMELAB-1327-subnet-router-state
aaron:plane/HOMELAB-1327-headscale-v0251
aaron:plane/HOMELAB-1327-ts-userspace
aaron:plane/HOMELAB-1327-headscale-rbac
aaron:fix/cilium-lb-accel-best-effort
aaron:fix/gateway-lb-ip-220
aaron:plane/HOMELAB-1326-runner-labels
aaron:fix/HOM-433-remove-sys-module
aaron:fix/HOM-433-remove-privileged
aaron:fix/HOM-434-wireguard-pin-image-tag
aaron:fix/wireguard-privileged
aaron:feat/HOM-400-wireguard
aaron:fix/HOM-326-webhook-statuscode-hotfix
aaron:paperclip/HOM-165-plugin-install
aaron:paperclip/HOM-164-fix-es-namespace
aaron:paperclip/HOM-164-alertmanager-paperclip-es
aaron:paperclip/HOM-309-code-server-httproute
aaron:feat/HOM-251-lidarr-prowlarr-ingress
aaron:fix/HOM-217-restore-gateway-routes
aaron:fix/HOM-121-quality-profile-cutoff
aaron:fix/HOM-121-lidarr-network-policy
aaron:fix/HOM-121-cronjob-ttl
aaron:feat/HOM-200-remove-httproutes
aaron:paperclip/HOM-138-remove-stale-dev-agent-refs
aaron:paperclip/HOM-126-forgejo-runner-token
aaron:paperclip/HOM-126-runner-token
aaron:feat/HOM-121-lidarr-flac-sync
aaron:paperclip/HOM-75-schema-name-fixes
aaron:paperclip/HOM-75-sabnzbd-api-key-drift
aaron:paperclip/HOM-74-revert-recyclarr-lidarr-config
aaron:paperclip/HOM-75-sabnzbd-config-script
aaron:paperclip/HOM-74-recyclarr-lidarr-flac-navidrome-cache-v2
aaron:paperclip/HOM-93-fix-lidarr-proxy-bind
aaron:paperclip/HOM-93-fix-lidarr-proxy-policy-probes
aaron:paperclip/HOM-93-fix-lidarr-proxy-dns-policy
aaron:paperclip/HOM-82-lidarr-rate-limit-nginx
aaron:paperclip/HOM-90-recyclarr-remove-lidarr-block
aaron:paperclip/HOM-82-lidarr-network-controls
aaron:paperclip/HOM-81-enforce-lidarr-auth
aaron:paperclip/HOM-73-lidarr-public
aaron:paperclip/HOM-74-recyclarr-lidarr-flac-navidrome-cache
aaron:feat/lidarr-config-automation
aaron:feat/media-stack-config
aaron:paperclip/HOM-67-media-runbooks
aaron:security/HOM-59-media-credentials
aaron:security/HOM-59-pss-baseline
aaron:paperclip/HOM-56-arr-stack
aaron:feat/pi-subagent-telemetry
aaron:paperclip/HOM-49-remove-stale-mgmt-ip
aaron:fix/gateway-dns-routing
aaron:fix/external-secrets-decommissioned-namespaces
aaron:plane/HOMELAB-1120-otel-telemetry
aaron:plane/HOMELAB-1130-forgejo-dns
aaron:plane/HOMELAB-1128-remove-local-paperclip-refs
aaron:paperclip/HOM-43-decommission-langfuse
aaron:paperclip/HOM-47-decommission-workadventure
aaron:paperclip/HOM-41-decommission-dev-agents
aaron:paperclip/HOM-46-decommission-lab-director
aaron:paperclip/HOM-42-decommission-dev-agents
aaron:paperclip/HOM-38-decommission-temporal
aaron:plane/HOMELAB-1107-ha-control-plane-kube-vip
aaron:plane/HOMELAB-1105-port-fix
aaron:fix/HOMELAB-1106-remove-mimir-from-otel
aaron:plane/HOMELAB-1105-dimensions-fix
aaron:plane/HOMELAB-1105-tempo-values-live
aaron:plane/HOMELAB-1105-upgrade-tempo-chart
aaron:plane/HOMELAB-1103-revert-config-override
aaron:plane/HOMELAB-1103-tempo-host-filtering
aaron:plane/HOMELAB-1104-paperclip-ssh-key-path
aaron:plane/HOMELAB-1099-fix-mgmt-vm-docs
aaron:plane/HOMELAB-1097-fix-db-permissions
aaron:feat/paperclip-remote-vm-execution
aaron:plane/HOMELAB-1096-pi-dashboards-with-metrics
aaron:plane/HOMELAB-1096-pi-sessions-dashboard
aaron:plane/HOMELAB-1092-otel-homelab-integration
aaron:fix/paperclip-recreate-strategy
aaron:paperclip/HOM-14-chart
aaron:homelab-1056-overwrite-false
aaron:fix/cnpg-wal-archive-alert
aaron:homelab-1056-terraform-drift
aaron:homelab-1053-remove-lab-director
aaron:plane/HOMELAB-1052-clickhouse-memory
aaron:plane/longhorn-singlerep-iac
aaron:plane/longhorn-restore-throttle-after-resilver
aaron:plane/longhorn-throttle-recovery
aaron:plane/HOMELAB-958-revert-maxpods
aaron:plane/HOMELAB-958-vm-ignore-cilium-churn
aaron:plane/HOMELAB-990-drop-wait-triggers
aaron:plane/HOMELAB-990-talos-cluster-bootstrap
aaron:plane/HOMELAB-994-cnpg-backups
aaron:plane/HOMELAB-988-runner-es-repoint
aaron:plane/HOMELAB-988-runner-fsgroup
aaron:plane/HOMELAB-988-runner-secrets
aaron:plane/HOMELAB-988-runner-image-bake
aaron:plane/HOMELAB-966-adr-amend
aaron:plane/HOMELAB-966-sops-operator
aaron:plane/HOMELAB-973-outline-probes
aaron:plane/HOMELAB-974-clickhouse-init-wait
aaron:plane/HOMELAB-971-intellimation-letterbox
aaron:plane/HOMELAB-970-ssd-tier-migration-spec
aaron:plane/HOMELAB-954-mapstorage-pvc
aaron:HOMELAB-969
aaron:HOMELAB-968
aaron:plane/HOMELAB-956-kubelet-maxpods
aaron:plane/HOMELAB-954-workadventure
aaron:fix/HOMELAB-860-talos-hostname-conflict
aaron:plane/HOMELAB-854-nats-deploy
aaron:plane/HOMELAB-847-nats-k8s-deployment
aaron:fix/minio-oom-pg-cascade
aaron:plane/HOMELAB-846-ch-memory
aaron:fix/HOMELAB-845-clickhouse-resources
aaron:fix/eso-lab-director-secrets
aaron:plane/HOMELAB-817-hostname-iac
aaron:plane/HOMELAB-817-hostname-in-iac
aaron:plane/HOMELAB-817-revert-hostname
aaron:plane/HOMELAB-817-hostname-fix
aaron:plane/HOMELAB-817-etcd-stability
aaron:plane/HOMELAB-809-setup-token
aaron:HOMELAB-819-alert-cleanup
aaron:fix/HOMELAB-811-etcd-disk-tuning
aaron:plane/HOMELAB-798-alert-investigation
aaron:plane/HOMELAB-797-alert-fix
aaron:plane/HOMELAB-796-cpu-throttling-fix
aaron:plane/HOMELAB-794-node-cpu-fix
aaron:plane/HOMELAB-793
aaron:plane/HOMELAB-791-alert-fix
aaron:plane/HOMELAB-787-alert-fix
aaron:plane/HOMELAB-783-alert-fix
aaron:plane/HOMELAB-782-fix-longhorn-degradation
aaron:plane/HOMELAB-781-alert-fix
aaron:plane/HOMELAB-780-node-saturation-fix
aaron:fix/lab-director-remove-subpath-mount
aaron:plane/HOMELAB-698-cnpg-alert-guard
aaron:plane/HOMELAB-698-cnpg-backup-alerts
aaron:plane/HOMELAB-585-fix-disk-io-saturation
aaron:plane/HOMELAB-584-fix-tempo-oom
aaron:plane/HOMELAB-580-fix-tempo-oom
aaron:plane/HOMELAB-568-fix-prometheus-for-syntax
aaron:plane/HOMELAB-547-memory-headroom-alerts
aaron:plane/HOMELAB-568-fix-alert-for-syntax
aaron:plane/HOMELAB-558-token-manager
aaron:plane/HOMELAB-553-dispatcher-restart
aaron:plane/HOMELAB-108-opnsense-firewall-rule
aaron:plane/HOMELAB-548-alert-auto-tickets
aaron:plane/HOMELAB-548-alert-auto-ticket-creation
aaron:plane/HOMELAB-550-fix-alert-permissions
aaron:fix/HOMELAB-546-sandbox-share-pid-namespace
aaron:fix/HOMELAB-545-memory-limits
aaron:plane/HOMELAB-549-fix-longhorn-alert
aaron:plane/HOMELAB-542-fix-critical-alerts
aaron:plane/HOMELAB-542-critical-alerts-triage
aaron:fix/HOMELAB-544-ksm-restart-loop
aaron:fix/token-refresh-schedule
aaron:fix/critical-alerts-live-homelab-542
aaron:fix/critical-alerts-triage-homelab-542
aaron:plane/HOMELAB-540-otel-filter
aaron:fix/sandbox-docker-writable
aaron:fix/sandbox-privileged-v3
aaron:fix/sandbox-privileged
aaron:fix/sandbox-privileged-v2
aaron:fix/sandbox-dev-kmsg-v2
aaron:fix/sandbox-share-docker-data
aaron:fix/sandbox-docker-socket
aaron:fix/sandbox-netpol-label
aaron:fix/token-refresh-backoff
aaron:plane/HOMELAB-516-sandbox-api-url
aaron:plane/HOMELAB-516-argocd-rbac
aaron:plane/HOMELAB-516-argocd-env-vars
aaron:plane/HOMELAB-516-sandbox-env-vars
aaron:plane/HOMELAB-510-simplify-harbor-route
aaron:plane/HOMELAB-510-harbor-gateway-tls
aaron:plane/HOMELAB-510-remove-harbor-route
aaron:plane/HOMELAB-510-harbor-route
aaron:plane/HOMELAB-476-langfuse-mcp
aaron:plane/HOMELAB-477-seccomp
aaron:plane/HOMELAB-478-fix-reflector-loop
aaron:plane/HOMELAB-477-token-refresh
aaron:fix/homelab-476-recreate-strategy
aaron:plane/HOMELAB-471-chart
aaron:plane/HOMELAB-469-deploy-ws-fix
aaron:homelab-474/lab-director-service-config
aaron:plane/HOMELAB-473-runner-cache
aaron:bump/lab-director-ab2dec6
aaron:plane/HOMELAB-469-bump-c11df5f
aaron:plane/HOMELAB-469-helm-fix
aaron:plane/HOMELAB-449-ui-phase1-helm
aaron:plane/HOMELAB-465-longhorn-cleanup
aaron:plane/HOMELAB-464-remove-mimir
aaron:plane/HOMELAB-463-wk02-cpu
aaron:plane/HOMELAB-462-infra-remediation
aaron:plane/HOMELAB-460-litellm-ollama
aaron:homelab-447-sandbox-env-vars
aaron:plane/HOMELAB-439-sandbox-ssh-permissions
aaron:plane/HOMELAB-437-disable-node-exporter
aaron:fix/HOMELAB-424-align-sandbox-values
aaron:plane/HOMELAB-433-alertmanager-pvc
aaron:HOMELAB-424-sandbox-helm-chart
aaron:plane/HOMELAB-433-temporal-prometheus-pvc
aaron:plane/HOMELAB-419-coredns-upstream-opnsense
aaron:plane/HOMELAB-416-single-devenv-image
aaron:plane/HOMELAB-404-chart-mode
aaron:plane/HOMELAB-404-temporal-env
aaron:homelab-406/ollama-resources
aaron:plane/HOMELAB-404-delete-worker-deployment
aaron:fix/HOMELAB-406-cluster-health
aaron:fix/HOMELAB-406-talos-version
aaron:plane/HOMELAB-404-devenv-temporal
aaron:fix/claude-agent-cluster-admin
aaron:plane/HOMELAB-395-temporal-ns
aaron:plane/HOMELAB-395-configmaps
aaron:plane/HOMELAB-397-agent-rbac
aaron:fix/temporal-schema-no-create-db
aaron:fix/HOMELAB-394-per-worker-storage-overrides
aaron:plane/HOMELAB-379-temporal-worker
aaron:fix/temporal-helm-values
aaron:plane/HOMELAB-378-temporal-server
aaron:plane/HOMELAB-377-temporal-cnpg
aaron:plane/HOMELAB-304-sha-tags-fix
aaron:plane/HOMELAB-316-runner-label
aaron:plane/HOMELAB-304-sha-tags
aaron:plane/HOMELAB-319-harbor-limits
aaron:plane/HOMELAB-319-forgejo-runner-k8s
aaron:plane/HOMELAB-278-devenv-fixes
aaron:plane/HOMELAB-287-ssh-key-eso
aaron:plane/HOMELAB-284-resource-scheduling
aaron:plane/HOMELAB-280-add-worker-node-03
aaron:plane/HOMELAB-274-fix-deployment
aaron:plane/HOMELAB-275-chart
aaron:plane/HOMELAB-272-remaining
aaron:plane/HOMELAB-272-api-fix
aaron:plane/HOMELAB-272-harbor-image
aaron:plane/HOMELAB-272-eso
aaron:feat/HOMELAB-262-zitadel-oidc
aaron:plane/homelab-254-dev-environment-chart
aaron:HOMELAB-256-langfuse-clickhouse-oom
aaron:plane/HOMELAB-236-litellm-model-fix
aaron:plane/HOMELAB-188-k8s
aaron:plane/HOMELAB-180-resource-limit-alerts
aaron:plane/HOMELAB-179-velero-sync-frequency
aaron:plane/HOMELAB-175-otel-retry-fix
aaron:plane/HOMELAB-175-langfuse-otel-litellm
aaron:plane/HOMELAB-176-release-versioning
aaron:plane/HOMELAB-173-worktree-setup
aaron:plane/HOMELAB-141-cilium-network-policies
aaron:plane/HOMELAB-159-langfuse-observability
aaron:plane/HOMELAB-151-harbor-rbac-admin-group
aaron:plane/HOMELAB-99-playwright-mcp-argocd
aaron:plane/HOMELAB-144-rbac-foundation
aaron:plane/HOMELAB-111-observability-dashboards
aaron:plane/HOMELAB-104-remove-coder
aaron:plane/HOMELAB-98-fix-bucket-url
aaron:plane/HOMELAB-98-expose-minio-public
aaron:plane/HOMELAB-72-outline-deployment
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".
No due date set.
Dependencies
No dependencies set.
Reference
aaron/infra-core!323
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "security/HOM-182-alertmanager-token-rotation-runbook"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Adds a runbook for rotating the Alertmanager → Paperclip webhook bearer token.
Security review: HOM-182
Parent: HOM-141
View command line instructions
Checkout
From your project repository, check out a new branch and test the changes.