> For the complete documentation index, see [llms.txt](https://docs.hivel.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.hivel.ai/self-managed-hivel-deployment/on-premises-generic/hivel-on-premises-deployment-guide-generic/security-and-secrets.md).

# Security and Secrets

## Security Principles

Understand these principles before managing credentials:

* Registry credentials and the default application-user password are issued by Hivel directly to your named contact. Never share them outside your organization.
* Store all credentials (registry keys, database passwords) in a secrets manager, not in plaintext files or source control. `.env` is a plaintext file by design - treat host filesystem access as sensitive.
* The superuser and root database credentials are used only for the one-time migration. Every service afterward runs on the scoped application user (principle of least privilege).

***

## Rotate Application Database Password

You can self-rotate the application database password at any time without re-running the Flyway migration.

### **Step 1: Generate a Strong Password**

**Application/Location:** Host (via SSH)

Generate a new random password:

```bash
openssl rand -base64 24
```

Copy the output for use in Step 2.

### **Step 2: Update Password at the Database**

**Application/Location:** Host (via SSH)

Connect to PostgreSQL and change the password:

```bash
sudo -u postgres psql -c "ALTER USER <user> WITH PASSWORD 'new_password_here';"
```

Replace `<user>` with your application user and `new_password_here` with the password from Step 1.

### **Step 3: Update `.env` File**

**Application/Location:** Host (via SSH)

Update the password in `config/.env`:

```bash
nano config/.env
```

Change:

```bash
DB_PASSWORD='new_password_here'
```

Follow the password-quoting rules in [Environment Configuration](https://docs.hivel.ai/self-managed-hivel-deployment/on-premises/environment-configuration).

### **Step 4: Recreate Containers**

**Application/Location:** Host (via SSH)

Env changes require containers to be recreated, not just restarted:

```bash
./deploy.sh --vm
```

**Important:** Existing pooled connections continue using the old password until they reconnect. Recreate containers immediately after changing the password to force all connections to re-authenticate.

***

## Rotate AWS ECR Registry Credentials

A rotation cadence or process for the ECR pull credentials Hivel issues is not documented here.

**Do this:** Contact your Hivel representative for guidance on rotating these credentials.

<br>

{% columns %}
{% column %} <a href="/self-managed-hivel-deployment/on-premises-generic/hivel-on-premises-deployment-guide-generic/uninstall-and-cleanup.md" class="button primary" data-icon="backward">Back to Uninstall and Cleanup</a>
{% endcolumn %}

{% column %}

{% endcolumn %}

{% column %} <a href="/self-managed-hivel-deployment/on-premises-generic/hivel-on-premises-deployment-guide-generic/support-handoff.md" class="button primary" data-icon="forward">Support Handoff</a>
{% endcolumn %}
{% endcolumns %}