Add credential rotation checklist (dw_admin pw + 2 Gemini keys + DTD-cleared Norma scoped rotation)

4fbb01c04845aee671b3e552e6965958f7df0b54 · 2026-06-01 12:56:50 -0700 · SteveStudio2
Files touched

A ROTATION-CHECKLIST.md
Diff

commit 4fbb01c04845aee671b3e552e6965958f7df0b54
Author: SteveStudio2 <stevestudio2@SteveStacStudio.lan>
Date:   Mon Jun 1 12:56:50 2026 -0700

    Add credential rotation checklist (dw_admin pw + 2 Gemini keys + DTD-cleared Norma scoped rotation)
---
 ROTATION-CHECKLIST.md | 59 +++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 59 insertions(+)

diff --git a/ROTATION-CHECKLIST.md b/ROTATION-CHECKLIST.md
new file mode 100644
index 0000000..f17152c
--- /dev/null
+++ b/ROTATION-CHECKLIST.md
@@ -0,0 +1,59 @@
+# Credential Rotation Checklist
+
+> Origin: 2026-05-30 Kamatera compromise. These are **console-only** actions —
+> Steve mints/changes the secret by hand, then routes it via `cli.js import-paste`.
+> Claude cannot mint keys or run prod credential changes. **No secret VALUES go
+> in this file** — only key names, mint URLs, and the route-back command.
+> Queued 2026-06-01.
+
+---
+
+## 1. PG `dw_admin` password  ⬜ OUTSTANDING  (P1 — the actual compromise fix)
+
+- **Exposed:** literal value was hardcoded in 14+ files on disk (scrubbed locally), and lives in Time Machine snapshots / Spotlight index / possibly remote git history.
+- **Runbook:** `~/Projects/_shared/docs/pg-rotation-runbook.md` (~32 min, includes the Kamatera mirror — prod + local both).
+- **Why it's the big one:** `dw_admin` is the shared admin used by wallco, the DW fleet, Norma's sdcc, etc. The Norma scoped rotation below does **not** fix this — it only moves Norma *off* `dw_admin`. `dw_admin` itself stays compromised until this runs.
+- **Console steps:** pick a new ≥20-char pw → `ALTER ROLE dw_admin WITH PASSWORD '…'` on **prod Kamatera** (`sudo -u postgres psql`) AND **local Mac2** → restart every consumer (pm2 fleet) → fan out.
+- **Route back after change:**
+  ```
+  printf 'DW_ADMIN_DB_PASSWORD=<NEW_PW>' | node ~/Projects/secrets-manager/cli.js import-paste
+  ```
+- **Verify:** `node ~/Projects/secrets-manager/cli.js check` (and confirm pm2 apps reconnect).
+
+## 2. Gemini API key #1  ⬜ OUTSTANDING
+
+- **Exposed:** hardcoded in 7 Patty routes + 3 DW docs.
+- **Mint:** https://aistudio.google.com/apikey  → create new key, **delete the old one** in the same console.
+- **Secret key name:** `GEMINI_API_KEY`  (confirm against `routes.json`).
+- **Route back:**
+  ```
+  printf 'GEMINI_API_KEY=<NEW_KEY>' | node ~/Projects/secrets-manager/cli.js import-paste
+  ```
+- **Verify:** `node ~/Projects/secrets-manager/cli.js check` (hits Gemini /models to validate).
+
+## 3. Gemini API key #2  ⬜ OUTSTANDING
+
+- **Exposed:** hardcoded in `PoppyPetitions/lib/gemini.ts`.
+- **Mint:** https://aistudio.google.com/apikey  → new key, delete old.
+- **Secret key name:** confirm which route this maps to (`GEMINI_API_KEY_RALPH` or a poppy-specific key in `routes.json`).
+- **Route back:**
+  ```
+  printf '<KEY_NAME>=<NEW_KEY>' | node ~/Projects/secrets-manager/cli.js import-paste
+  ```
+- **Verify:** `node ~/Projects/secrets-manager/cli.js check`.
+
+---
+
+## Related — Norma sdcc scoped rotation  (DTD-cleared 2026-06-01: Lane A)
+
+Not a console mint — a scoped PG role swap. **DTD verdict: A (scoped-now), 2/2 valid panelists.**
+Pre-flight (read-only, 2026-06-01) confirmed safe to run:
+- `~/Projects/Norma/.env.local` exists ✓
+- Norma currently connects as **`dw_admin`** on local `sdcc` → this moves it to a least-privilege scoped user ✓
+- `norma_app_user` does **not** exist yet → script CREATEs it; no other consumer uses it, so the "scoped is illusory" caveat does NOT apply ✓
+- Leaves shared `dw_admin` untouched (so the 5 social procs + sdcc-images viewer + replication keep working)
+
+```
+~/Projects/_shared/scripts/rotate-pg-scoped.sh ~/Projects/Norma sdcc norma_app_user NORMA_APP_DB_PASSWORD
+```
+**Caveats:** (a) the script is **LOCAL-only** (`127.0.0.1:5432`) — it does not touch prod Kamatera; (b) it's **interactive** (type the new ≥16-char pw twice at the prompt — the header's "pipe via stdin" is stale); (c) it does **not** rotate `dw_admin` — that's item #1 above.
← 89bebba durable daily post-bubbe Tier-1 secret-rotation reminder · back to Secrets Manager · credentials/tokens update tracker web viewer (:9778) + dw_ad c35aa92 →