The previous SNMP community was committed to this public repository in plaintext and shared across pfSense, iLO, the MokerLink switch and the APC UPS. It must be treated as public — a single read credential for every piece of network gear at once.
Needs physical/admin access to each device, so it cannot be done from the repo side.
Runbook: docs/runbooks/rotate-snmp-community.md
Steps
Notes
The repo side is already prepared: the community is a SOPS-encrypted value rendered into snmp.yaml at deploy time by scripts/render-config.sh, and never written to disk in the working tree. Rotation is an edit to the encrypted file plus a redeploy.
Related: moving to SNMPv3 authPriv is tracked separately in docs/roadmap.md. pfSense, the APC and iLO all support it; the MokerLink switch does not, which is what blocks doing it uniformly.
The previous SNMP community was committed to this public repository in plaintext and shared across pfSense, iLO, the MokerLink switch and the APC UPS. It must be treated as public — a single read credential for every piece of network gear at once.
Needs physical/admin access to each device, so it cannot be done from the repo side.
Runbook:
docs/runbooks/rotate-snmp-community.mdSteps
make secrets-editto updatesecrets/observability.sops.yamlmake upand confirm all four SNMP targets areupin PrometheusNotes
The repo side is already prepared: the community is a SOPS-encrypted value rendered into
snmp.yamlat deploy time byscripts/render-config.sh, and never written to disk in the working tree. Rotation is an edit to the encrypted file plus a redeploy.Related: moving to SNMPv3 authPriv is tracked separately in
docs/roadmap.md. pfSense, the APC and iLO all support it; the MokerLink switch does not, which is what blocks doing it uniformly.