Credential Rotation Runbook: Rotating the Sigils

owner: “Security Operations” classification: “RESTRICTED” tags: [“credentials”, “rotation”, “secrets”, “api-keys”, “fido2”, “gpg”]

1. Purpose

This runbook governs Rotating the Sigils — the periodic renewal of all cryptographic credentials used by the Alter.

2. Rotation Schedule

Credential	Frequency	Owner	Automation
VirusTotal API Key	90 days	SecOps	Manual (VT console)
AbuseIPDB API Key	90 days	SecOps	Manual (AbuseIPDB console)
OTX AlienVault Key	90 days	SecOps	Manual (OTX console)
Tailscale Auth Key	180 days	NetOps	tailscale authkey create
GPG Signing Key	365 days	Evidence Custodian	Manual ceremony
FIDO2 Resident Key	365 days	Evidence Custodian	fido2-token re-enroll
Container Registry Token	90 days	Platform	CI/CD pipeline
Tetragon gRPC Cert	365 days	Platform	cert-manager

3. Rotation Procedures

3.1 VirusTotal / AbuseIPDB / OTX Keys

1. Generate new key in provider console
2. Update in secret store:

   synos-secrets set VT_API_KEY <new-key>
   synos-secrets set ABUSEIPDB_API_KEY <new-key>
   synos-secrets set OTX_API_KEY <new-key>

3. Update enrich cache:

   rm -rf /tmp/enrich-cache
   enrich-iocs.sh test/sample.json --no-vt --no-abuseipdb --no-otx

4. Verify:

   enrich-iocs.sh test/sample.json | jq '.enrichment[].source'

3.2 Tailscale Auth Key

# Create new key (reusable, ephemeral=false)
tailscale authkey create --reusable --tag=chamber-node --expiry=180d

# Update in all chamber nodes (via Ansible/salt)
ansible chamber-nodes -m shell -a "tailscale up --authkey=<new-key>"

3.3 GPG Signing Key

1. Generate new subkey on offline machine:

   gpg --expert --full-gen-key
   # Select: RSA (sign only), 4096 bits, 1y expiry

2. Export public key:

   gpg --export --armor <key-id> > /opt/synos/keys/evidence-signing.pub

3. Update sign-evidence.sh to use new key:

   sign-evidence.sh --key <new-key-id> ...

4. Revoke old subkey after 30-day overlap:

   gpg --revoke <old-subkey-id>

3.4 FIDO2 Resident Key

1. Enroll new credential on FIDO2 token:

   fido2-token -M -i <credential-id> /dev/hidraw0

2. Update sign-evidence.sh:

   sign-evidence.sh --fido2 --key <new-credential-id> ...

3. Verify:

   sign-evidence.sh MAL-TEST-001 verify --fido2

3.5 Container Registry Token

# GitHub Container Registry
gh auth token | docker login ghcr.io -u <user> --password-stdin

# Update in CI/CD
gh secret set CONTAINER_TOKEN --body "<token>" -R Lum0s-Solutions/synos

4. Verification Checklist

After each rotation, verify:

• All services authenticate with new credentials
• Enrichment pipeline works (enrich-iocs.sh test)
• Evidence signing works (sign-evidence.sh test verify)
• Tailscale mesh connected (tailscale status)
• CI/CD builds pass

5. Emergency Rotation

If credential compromise suspected:

1. Immediately revoke compromised credential
2. Generate replacement
3. Deploy to all affected systems within 1 hour
4. Audit access logs for anomalous activity
5. Document in incident log

6. Contacts

Credential	Owner	Backup
VT/AbuseIPDB/OTX	@secops-lead	@secops-backup
Tailscale	@netops-lead	@netops-backup
GPG/FIDO2	@evidence-custodian	@evidence-backup
Container/Registry	@platform-lead	@platform-backup