Retire rotate-token's group rotation once allod secret rotate is deployed; decide where refresh-local-auth lives #52

New issue

Closed

opened 2026-09-11 05:51:32 +01:00 by vnprc-agent · 0 comments

vnprc-agent commented

2026-09-11 05:51:32 +01:00

Retire rotate-token's group rotation once allod secret rotate (allod/tools#197) is deployed on the host, so value rotation has one implementation, and decide what becomes of refresh-local-auth, which that command deliberately does not absorb.

Primary goals:

One rotation path — after the allod-tools pin carries allod secret rotate, the rotate, --group, --forgejo-token, and single-secret paths of scripts/rotate-token and their tests are removed, and the docs point at the command.
refresh-local-auth keeps a home — it installs root and user netrc bundles under sudo, a privilege class allod secret does not hold, which is why allod/tools#197 prints it as the operator's next step rather than running it. It stays a host script: either the remaining rotate-token refresh-local-auth, or a script of its own name, decided here.
Nothing retires before the replacement is proven — the first live rotation runs allod secret rotate --dry-run, then the real run, then the printed verification, before any bash path is deleted.

Current state and specifics

scripts/rotate-token is about 1500 lines with 37 tests covering group selection, three plaintext formats, dry runs, printed instructions, and local auth refresh. allod/tools#197 ports everything except refresh-local-auth into Go behind the secret tag, with the same printed steps; the deploy step it prints for a group with local_auth_refresh entries is rotate-token refresh-local-auth --group <alias>, so that spelling must survive whatever the retirement decides, or the tools side changes with it.

Scope

In: the removal, the local-auth decision, the docs, and the pin advance that carries the replacement. Out: changes to the rotation registry's name or shape (its own issue in allod/secrets).

Retire `rotate-token`'s group rotation once `allod secret rotate` (allod/tools#197) is deployed on the host, so value rotation has one implementation, and decide what becomes of `refresh-local-auth`, which that command deliberately does not absorb. Primary goals: - **One rotation path** — after the `allod-tools` pin carries `allod secret rotate`, the `rotate`, `--group`, `--forgejo-token`, and single-secret paths of `scripts/rotate-token` and their tests are removed, and the docs point at the command. - **`refresh-local-auth` keeps a home** — it installs root and user netrc bundles under sudo, a privilege class `allod secret` does not hold, which is why allod/tools#197 prints it as the operator's next step rather than running it. It stays a host script: either the remaining `rotate-token refresh-local-auth`, or a script of its own name, decided here. - **Nothing retires before the replacement is proven** — the first live rotation runs `allod secret rotate --dry-run`, then the real run, then the printed verification, before any bash path is deleted. ### Current state and specifics `scripts/rotate-token` is about 1500 lines with 37 tests covering group selection, three plaintext formats, dry runs, printed instructions, and local auth refresh. allod/tools#197 ports everything except `refresh-local-auth` into Go behind the `secret` tag, with the same printed steps; the deploy step it prints for a group with `local_auth_refresh` entries is `rotate-token refresh-local-auth --group <alias>`, so that spelling must survive whatever the retirement decides, or the tools side changes with it. ### Scope In: the removal, the local-auth decision, the docs, and the pin advance that carries the replacement. Out: changes to the rotation registry's name or shape (its own issue in `allod/secrets`).

Rows
Columns