Skip to content
  • Sean McGivern's avatar
    Store OTP secret key in secrets.yml · ac2221b2b021
    Sean McGivern authored
    .secret stores the secret token used for both encrypting login cookies
    and for encrypting stored OTP secrets. We can't rotate this, because
    that would invalidate all existing OTP secrets.
    
    If the secret token is present in the .secret file or an environment
    variable, save it as otp_key_base in secrets.yml. Now .secret can be
    rotated without invalidating OTP secrets.
    
    If the secret token isn't present (initial setup), then just generate a
    separate otp_key_base and save in secrets.yml.
    
    Update the docs to reflect that secrets.yml needs to be retained past
    upgrades, but .secret doesn't.
    ac2221b2b021