Rotating secrets

Tenant API key. Add a key, move your clients to it, then revoke the old one:

DC="docker compose --env-file .env -f deploy/docker-compose.yml"
$DC exec ohs /ohs admin tenant list
$DC exec ohs /ohs admin key create --tenant <tenant id>
$DC exec ohs /ohs admin key list --tenant <tenant id>
$DC exec ohs /ohs admin key revoke --tenant <tenant id> --key <old prefix>

A user token minted with the old key keeps working until it expires. key revoke with a whole user token (ohs_ut_...) revokes that token.

OHS_ENCRYPTION_KEY. Rotate it online: put the new key in OHS_ENCRYPTION_KEY and the old one in OHS_PREVIOUS_ENCRYPTION_KEYS, restart every process, run ohs admin rekey, then remove the old key once ohs doctor says nothing uses it. The whole procedure, and what happens when a step is skipped, is in rotating the encryption key. Replacing the key without keeping the old one leaves the stored OAuth tokens and webhook secrets unreadable: each user must connect the provider again. Uploads and stored data are not affected.

Provider secrets. See the Withings note under operating notes below.

POSTGRES_PASSWORD only applies when the database volume is first created. To change it later, run ALTER USER ohs PASSWORD '...' in psql, then update .env and recreate both containers.