Security and Secrets
Security Principles
Understand these principles before managing credentials:
Registry credentials and the default application-user password are issued by Hivel directly to your named contact. Never share them outside your organization.
Store all credentials (registry keys, database passwords) in a secrets manager, not in plaintext files or source control.
.envis a plaintext file by design - treat host filesystem access as sensitive.The superuser and root database credentials are used only for the one-time migration. Every service afterward runs on the scoped application user (principle of least privilege).
Rotate Application Database Password
You can self-rotate the application database password at any time without re-running the Flyway migration.
Step 1: Generate a Strong Password
Application/Location: Host (via SSH)
Generate a new random password:
openssl rand -base64 24Copy the output for use in Step 2.
Step 2: Update Password at the Database
Application/Location: Host (via SSH)
Connect to PostgreSQL and change the password:
Replace <user> with your application user and new_password_here with the password from Step 1.
Step 3: Update .env File
Application/Location: Host (via SSH)
Update the password in config/.env:
Change:
Follow the password-quoting rules in Environment Configuration.
Step 4: Recreate Containers
Application/Location: Host (via SSH)
Env changes require containers to be recreated, not just restarted:
Important: Existing pooled connections continue using the old password until they reconnect. Recreate containers immediately after changing the password to force all connections to re-authenticate.
Rotate AWS ECR Registry Credentials
A rotation cadence or process for the ECR pull credentials Hivel issues is not documented here.
Do this: Contact your Hivel representative for guidance on rotating these credentials.
Last updated