Security Hardening and Rotation

Security Baseline

Production deployments should have:

• HTTPS for all user traffic.
• PostgreSQL, Redis, management gRPC, and metrics not exposed publicly.
• Root password, every security-domain key, and the cluster secret managed in a Secret Manager or Kubernetes Secret.
• No default weak secrets.
• Database and secrets backed up and restored together.
• Metrics restricted by source or authentication.

Secret Classes

Secret	Impact if lost	Rotation difficulty	Handling
jwt.secret	Existing tokens become invalid	Medium	Plan rotation and expect re-login
security.opaque_server_setup_secret	OPAQUE password records may fail	High	Do not routinely rotate; back it up
security.credential_encryption_key	Encrypted Provider credentials cannot be decrypted	High	Migrate credentials before replacement
security.totp_encryption_key	Existing TOTP enrollment cannot be verified	High	Migrate ciphertext or schedule user re-enrollment
security.email_outbox_encryption_key	Queued email payloads cannot be decrypted	High	Drain the queue, then replace it on every replica together
Proxy, media-swarm, provider-session, and file-token keys	Issued URLs, announcements, sessions, or tokens expire	Medium	Replace on every replica and accept the short-lived expiry
Login-discovery and WebAuthn-enumeration keys	Temporary decoys change	Low	Replace on every replica together
cluster.secret	Node-to-node auth fails	Medium	Coordinate all replicas
management.auth_token	CLI/management TCP auth	Low	Rotate regularly if TCP is used
metrics.auth.bearer_token	Metrics scrape auth	Low	Sync monitoring config
SMTP/OAuth2/Provider credentials	Email, login, or media failures	Medium	Follow upstream rotation policy

Caution

Do not treat the OPAQUE setup secret or credential encryption key as ordinary tokens. They are bound to stored authentication data and encrypted Provider credentials.

Pre-rotation Checklist

1. Back up PostgreSQL, config files, and all production secrets.
2. Identify the target and blast radius: login, Provider credentials, cluster, management, or metrics.
3. Validate in a production-like test environment.
4. Prepare rollback: old secret, old config, old image, or database backup.
5. Notify users if re-login or Provider rebind may be required.
6. Rotate during a quiet window and watch login failures, Provider decrypt errors, and WebSocket reconnects.

Common Rotation Flows

JWT secret

1. Generate a new secret.
2. Update secret storage.
3. Restart all SyncTV replicas.
4. Expect old access and refresh tokens to fail.
5. Watch 401, login success rate, and WebSocket reconnects.

Management token

1. Generate a new token.
2. Update management.auth_token or _file.
3. Restart the relevant service entry.
4. Update CLI environment or Secret.
5. Validate with synctv system stats.

Metrics token

1. Generate a new bearer token.
2. Update SyncTV metrics config.
3. Update Prometheus, ServiceMonitor, or scraper Secret.
4. Verify old token fails and new token succeeds.

Cluster secret

1. Prepare a maintenance window.
2. Ensure all replicas will use the same new value.
3. Roll or restart replicas; node-to-node failures may occur during the transition.
4. Watch heartbeat, Redis pub/sub, and cross-node WebSocket events.

Applying Kubernetes Secret Changes

Helm injects Secrets through environment variables. Change the version marker in values to trigger a rollout after updating the Secret:

existingSecret: "synctv-production-secret"
secretRolloutChecksum: "2026-07-28-jwt-rotation"

helm upgrade --install synctv ./helm/synctv \
  -n synctv \
  -f values.production.yaml
kubectl -n synctv rollout status deploy/synctv

When a Secret controller updates the object without a Reloader, restart the Deployment explicitly and wait for every replica:

kubectl -n synctv rollout restart deploy/synctv
kubectl -n synctv rollout status deploy/synctv

Cluster, signing, and encryption key rotations must converge every replica on the same version. Watch node authentication, login, and decryption errors throughout the rollout.

Credential Encryption Key Migration

If security.credential_encryption_key must change, do not simply replace it and start the service. A safe flow is:

1. Back up the database and old key.
2. Stop writes to Provider credentials.
3. Decrypt existing Provider credentials with the old key.
4. Encrypt them with the new key and write them back.
5. Update configuration to the new key.
6. Start SyncTV and verify Provider login, browse, and playback.

If no migration tool exists, keep the old key or delete and recreate affected Provider credentials.

OPAQUE Setup Secret

The OPAQUE setup secret is a long-lived server secret for password authentication. Do not rotate it unless you have an account password migration or forced reset plan.

If it leaks:

• Assess scope immediately.
• Force password reset or OPAQUE record recreation.
• Rotate JWT secret and clear sessions.
• Keep audit records and an incident timeline.

Hardening Checklist

Item	Action
TLS	Public traffic only over HTTPS/WSS
CORS	Allow only real frontend origins, no path
Trusted proxy	Trust only actual reverse proxy addresses
Rate limits	Configure login, verification, WebSocket, and API limits
WebAuthn	Match rp_origin to real HTTPS origin
OAuth2	Exact redirect URL and Redis-backed state
Provider	Encrypt credentials; no tokens in sourceConfig
Logs	JSON logs without secrets, cookies, or JWTs
Metrics	No public exposure; use bearer or platform auth
Backups	Back up and restore database and secrets together