What each credential is, where it lives, and what happens when it changes. Creating, changing or replacing a credential is [dev-OTS] and carries sensitive-data; never paste a value into a ticket, chat, commit or PR. Nothing here is pre-signed.
| credential | lives in | how it changes | effect |
|---|---|---|---|
Database passwords (tamanu, reporting, raw) |
Derived from the machine id, the secret salt and the role name. Written to PostgreSQL, /etc/tamanu/env and local.json5. |
Changing salt, or rebuilding the machine, changes every one. Re-running tamanu-install.yml writes the new values to all three places. |
The running services keep their open connections and the old password in memory until they restart. Plan a restart (restart services). |
Tamanu auth.secret and refresh secret |
Derived the same way, but written to production.json5 once and then preserved. |
Changing salt does not change them on an existing server. |
None until a developer edits production.json5. |
Server key tamanu-config-key |
Podman secret on the host, 32 random bytes | Never regenerated by the playbooks. | Anything Tamanu encrypted under the old key is unreadable under a new one. Do not recreate it; escalate. A clone replaces it on purpose (clone runbook). |
| Route 53 access keys for DNS-01 (external servers) | The secret variable tamanu_caddy_tls_dns_iam, written to /var/lib/caddy/.aws/credentials |
Infrastructure code never creates them. A human creates a key for the IAM user in acmeDnsUsers, stores it in Canopy, and runs tamanu-install.yml --tags caddy --limit <host>. Then check certificates and delete the old key in IAM. |
A wrong key fails renewals, not the current certificate. |
| ZeroSSL key | caddy_zerossl_api_key |
Same path as above. | Adds or removes an issuer. |
| Elastic enrolment token | elastic_agent_enrollment_token, a secret |
Update in Canopy and run the elastic tag. |
Absent token with the agent enabled removes the agent. |
| Tailscale join key | Instance user data, single use, 6 hours | Not rotated. It exists only for first boot. | Ordinary membership is renewed by Tailscale. |
| Backup credentials | Short-lived, issued by Canopy per run | Canopy issues them. | See LNXBAK. |
| Clone sync passwords | /etc/bestool/clone-sync/<name>.password on the clone central, copied to /etc/tamanu/clone-sync-password on the facility |
Delete the password file on the central, re-run tamanu-install.yml, then run /etc/bestool/clone-setup.sh on the central and on the facility. |
The facility cannot sync until setup completes. |
The IAM access keys of the acmeDnsUsers can change only _acme-challenge TXT records for that server's names (LNXTLS); treat them as secrets anyway.
Keep client and host names out of any note about the change.