Secrets and Rotations
This page covers SynckHub-managed deployments. Customer-operated Free Self-Hosting uses the exact
offline rotation commands in the pinned env/self-hosted/README.md; it has no Common notify token,
vendor support credential, or SynckHub Vault entry.
Expired secrets are predictable outages.
Treat rotation as scheduled work, not incident work.
High-impact rotation targets
- GHCR pull token
- Common notify token
- SynckHub infra tokens
- Microsoft app client secret
- WOPI token signing secret
- Postgres passwords
Rotation rules
- rotate one class of secret at a time
- verify service health after each rotation
- keep rollback path for each step
- update Vault and deployment state together
Common anti-pattern
Manual secret edits outside audited workflow create state divergence you cannot reason about later.