From 1f37857acc5ad190d9537745a76deb490b5f0e81 Mon Sep 17 00:00:00 2001 From: Vuong Hoang Date: Thu, 14 May 2026 15:34:02 -0700 Subject: [PATCH] servers/pfi-postgres: drop stale "Known weak password (rotate)" section MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Section claimed gitea + paperless-ng Postgres passwords were "currently in use" with trivial values and that rotation was pending. Per STATUS.md: "Rotate exposed secrets — done 2026-04-23. All six rotated: vaultwarden/gitea/paperless-ng Postgres passwords (hardcoded compose.yaml literals moved to gitignored .env files in the process)..." Rotation happened; literals are no longer in compose.yaml; passwords are no longer trivial. Removing the section rather than amending — once fixed, there's no value in carrying a "we have weak passwords" section that lies about the current state. Surfaced by /tend-docs audit 2026-05-14. --- servers/pfi-postgres/README.md | 10 ---------- 1 file changed, 10 deletions(-) diff --git a/servers/pfi-postgres/README.md b/servers/pfi-postgres/README.md index 466e92a..bb8f9d1 100644 --- a/servers/pfi-postgres/README.md +++ b/servers/pfi-postgres/README.md @@ -36,16 +36,6 @@ Shared Postgres server backing multiple ana-docker stacks: - **File-level restic on this host:** ❌ not configured. Optional — the VM-image + per-consumer pg_dumps together cover most recovery paths. -## Known weak password (rotate) - -The inline passwords currently in use for these databases are -trivially weak: -- `gitea` / `gitea` -- `paperless-ng` / `paperless-ng` - -Rotation is on the post-backup-pipeline cleanup list. Exposed in the -2026-04-21 transcripts. - ## Refresh state ```bash