P16: Provision Hardening — resilient credential rotation
Harden the provisioning pipeline so credential rotation survives deploy failures. Decouple provision from deploy success, replace docker exec with direct API/SQL connections, add retry logic with rollback, sync rotated credentials to Woodpecker secrets, and fix SQL injection in password rotation.
Closeout
All 11 issues closed. Root cause analysis revealed provision had never actually run — credential rotation was broken from inception. Fixed by integrating provision into the deploy step as a two-phase rotation: rotate first, verify, then commit. Replaced docker exec psql with direct PostgreSQL connections and docker exec gitea with Gitea API calls for password rotation. Added retry logic with graceful degradation, rollback on failed rotation, and a credential consistency health check. Fixed SQL injection vulnerability in provision_postgres password rotation. Prevented deploy git reset from clobbering .env. Rotated credentials now sync to Woodpecker secrets automatically.
Issues resolved
- #108 — Decoupled provision from deploy success
- #109 — Direct PostgreSQL connection replaces docker exec psql
- #110 — Gitea API replaces docker exec gitea for password rotation
- #111 — Retry logic and graceful degradation
- #112 — Credential sync to Woodpecker secrets
- #113 — SQL injection fix in password rotation
- #118 — RCA: provision never ran from inception
- #119 — Two-phase rotation integrated into deploy
- #120 — Credential consistency health check
- #121 — Rollback on failed rotation
- #122 — Prevent deploy git reset from clobbering .env
Residual
P18 (Safe Credential Rotation) deferred — atomic per-commit rotation with rollback depends on rootless Docker, which is not yet deployed.
