feat: add key autorotate policy#900
Open
Manuthor wants to merge 6 commits into
Open
Conversation
Manuthor
force-pushed
the
feat/key_autorotate_policy
branch
6 times, most recently
from
ef7ba40 to
8e7485d
Compare
Manuthor
force-pushed
the
feat/key_autorotate_policy
branch
4 times, most recently
from
948fe9f to
114b984
Compare
HatemMn
reviewed
Apr 17, 2026
Contributor
HatemMn
left a comment
HatemMn
left a comment
There was a problem hiding this comment.
Partial review only,
UI review will follow soon
As a general comment, some clippy allow might be omitted or if they are necessary is it possible to pls add a comment in from of them to explain "why" ? (otherwise they will be catched at later works)
HatemMn
reviewed
Apr 17, 2026
Contributor
HatemMn
left a comment
HatemMn
left a comment
There was a problem hiding this comment.
Other than than those comments amazing work, looks good and working well !
Manuthor
force-pushed
the
feat/key_autorotate_policy
branch
from
065a9a4 to
7c3c6e7
Compare
Manuthor
force-pushed
the
feat/key_autorotate_policy
branch
from
3cc9c88 to
f87b359
Compare
Manuthor
force-pushed
the
feat/key_autorotate_policy
branch
from
b38c497 to
76d0a51
Compare
…o feat/multi_hsm_support)
Manuthor
force-pushed
the
feat/key_autorotate_policy
branch
from
76d0a51 to
348d562
Compare
The validation enforcing rotate_interval >= 86400 was guarded only by #[cfg(not(feature = "insecure"))], but Nix CI builds tests without the insecure feature, causing all rekey_rotation_tests to fail with "rotate_interval must be 0 (disabled) or at least 86400 (1 day)". Guard with #[cfg(not(any(feature = "insecure", test)))] so unit-test builds (which always set cfg(test)) can use small intervals for fast lifecycle tests, while production builds still enforce the 1-day floor.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Key Auto-Rotation (Scheduled / Policy-Driven)
ReKeylinks old and new keys viaReplacementObjectLink/ReplacedObjectLink(#859).run_auto_rotation()scans all objects due for rotation and rotates them automatically; supportsSymmetricKey(ReKey),Certificate(Certify upsert), andPrivateKey/PublicKey(RSA/EC/PQC key pairs).rotate_interval,rotate_name,rotate_offsetfrom the old key; old key getsrotate_interval = 0to prevent re-rotation."toto_<uuid>"children; UUID suffix stripped on subsequent rotations.ReplacementObjectLink/ReplacedObjectLink; serial number mixed with timestamp to guarantee unique DER bytes per RFC 5280.sym keys set-rotation-policysub-command;--rotate-interval/--rotate-name/--rotate-offsetflags on allcreatecommands;re-keysub-commands for RSA, EC, PQC.--auto-rotation-check-interval-secsto configure the background cron interval.Renewal Notification System
NotificationsStoretrait: backed by SQLite, PostgreSQL, MySQL (notificationstable); Redis uses a no-op store.dispatch_renewal_warnings: scans objects approaching rotation deadline, creates DB notifications, and sends e-mails via optional SMTP notifier (no feature flag — controlled byKMS_SMTP_HOST).GET /api/notifications,GET /api/notifications/count-unread,POST /api/notifications/{id}/read,POST /api/notifications/read-all.NotificationBellin header with live unread badge and inline Popover; full list at/notifications.SmtpConfig::Debugredacts the SMTP password with<redacted>.Closes #859