mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-10 12:47:04 +00:00
kevinveenbirkenbachandClaude Opus 5.5
fa39151f1f
Every shared Redis consumer authenticates as the default user with REDIS_PASSWORD (plugins/lookup/engine.py). The rotation gate between PASS 1 and PASS 2 changes that password, the engine restarts with only the new one, and every consumer deployed later in the pass keeps the old secret. In fork run 42305502796, Nextcloud#7 direct then crash-looped Nextcloud and Weblate from 02:50:31 until the deploy cap killed the job (about 2600-2700 WRONGPASS lines per node, host CPU pressure from 25 % to 80 %). 00_core now reads the password hashes a healthy engine accepts before the restart and adds the replaced ones back after it. Once every server role has redeployed, tasks/stages/02_server.yml retires them before the end-to-end tests: only the current password is left, the ACL log is reset and every client is disconnected. After the tests, a verify step in the test runtimes fails the pass on every authentication Redis refused since the retire, so a consumer that never picked up the new secret still fails loudly. The rotation gate is unchanged. The README no longer describes per-consumer ACL users that never existed. 🎯 Fix: 88 % 💥 Break: 6 % 💸 Cost: – ⏱️ Time: – 🛡️ Security: 100 % 🏆 Score: 83 🚦 Gate: ⛔ fix 88 % < 90, break 6 % > 5 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>