diff options
| author | Luke Hoersten <[email protected]> | 2026-10-26 20:37:55 -0500 |
|---|---|---|
| committer | Luke Hoersten <[email protected]> | 2026-10-26 20:52:00 -0500 |
| commit | ba52aeda713b10aafed7d49f666c44c69f717964 (patch) | |
| tree | db47b33e942ca24684417eefc6fc51ae142ea004 | |
| parent | bc62302ff95920f799ce07a77adb81acec8de98a (diff) | |
The password-update task was gated behind soju_reset_password, which
nothing ever set. A vault password rotation silently never took effect,
so soju kept authenticating against the pre-rotation password for 7
months. Track a hash of the last-applied password instead and reapply
whenever it differs from the vault, so a rotation takes effect on the
next run without a manual nudge.
| -rw-r--r-- | soju/tasks/main.yaml | 22 |
1 files changed, 18 insertions, 4 deletions
diff --git a/soju/tasks/main.yaml b/soju/tasks/main.yaml index f461eb8..e18c125 100644 --- a/soju/tasks/main.yaml +++ b/soju/tasks/main.yaml @@ -77,8 +77,23 @@ no_log: true notify: restart soju -# Gated: an unconditional reset re-keys the account on every run, clobbering -# any password changed in-band and locking out logged-in clients. +# The vault is the only source of truth for this password (no in-band IRC +# changes), so re-apply whenever it differs from what was last applied, +# rather than requiring a manually-passed flag that's easy to forget after +# a vault rotation (soju kept authenticating against a pre-rotation +# password for 7 months because of exactly that - nothing ever set the +# flag). The marker tracks a hash, not the password itself, so re-running +# with an unchanged password is a no-op and doesn't restart (and +# disconnect) a live bouncer. +- name: track applied soju admin password + become: yes + copy: + content: "{{ soju_admin_password | hash('sha256') }}" + dest: "/etc/soju/.admin_password_applied" + mode: "0600" + register: soju_password_marker + no_log: true + # sojudb writes the database behind the running daemon's back and soju # authenticates against its in-memory copy, so the restart notify is what # makes the new password actually take effect. @@ -88,9 +103,8 @@ command: "sojudb -config /etc/soju/config change-password {{soju_admin_user}}" args: stdin: "{{soju_admin_password}}" - changed_when: true no_log: true - when: soju_reset_password | default(false) | bool + when: soju_password_marker is changed notify: restart soju - name: install nginx stream config |