Davidian1024/fctc-website-under-construction
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Keep the Cloudflare token out of stack config

Browse Source 
pulumi config set --secret writes ciphertext into Pulumi.dev.yaml, which is
committed, alongside the encryptionsalt. This stack's secrets provider is a
passphrase, and the passphrase is the empty string documented three lines above
it in the README. That combination is not encryption — it is the token spelled
differently, readable by anyone with access to this repo.

pulumi-cloudflare falls back to CLOUDFLARE_API_TOKEN when cloudflare:apiToken
is absent from config, so __main__.py is unchanged and so is pulumi up. The
token simply stops living in git.

The empty passphrase is left as it is. It protects nothing precisely because
nothing secret is in config any more, and that is what makes it harmless; the
notes now say to change the secrets provider before adding a secret at rest.

This does NOT un-expose the existing token. The value is still readable in this
branch's history at 94dd775, and history rewriting would not help either, since
it has been pushed since 2026-09-09. Only rotating the credential closes that;
notes/CLOUDFLARE.md now covers how, including checking Last used before
deleting the token, which is the only record of whether it was ever used.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Raúl Montejo
2026-09-17 23:27:08 -04:00
parent 94dd775061
commit f00a96c40b
4 changed files with 64 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
infra/notes/PASSPHRASE.md
View File

@@ -1,3 +1,16 @@
## The passphrase
The `dev` stack uses Pulumi's passphrase secrets provider with an **empty passphrase**,
set in the bootstrap steps in `../README.md`.
That is fine only while **no secret is stored in stack config**. An empty passphrase plus
the `encryptionsalt` committed in `Pulumi.dev.yaml` means any `secure:` value in that file
is recoverable by anyone who can read this repo. The Cloudflare token therefore lives in
`CLOUDFLARE_API_TOKEN` in the environment instead — see `./CLOUDFLARE.md`.
**Before putting any secret in stack config, change the secrets provider.** Otherwise the
value is public to everyone with repo access the moment it is committed.
## Updating the passphrase
pulumi stack change-secrets-provider passphrase
pulumi stack change-secrets-provider passphrase