Skip to content
Holden

Rotating password_seed

When: Database passwords may have been exposed.

Impact: All derived passwords change. Databases will reject connections until updated.

Steps

Section titled “Steps”

  1. Stop all apps:

    Terminal window
    docker stop $(docker ps -q --filter label=holden.managed=true)

  2. Update each database password manually:

    PostgreSQL:

    Terminal window
    docker exec -it myapp-needs-postgres psql -U postgres -c \
      "ALTER USER myapp PASSWORD 'new-password';"

    Valkey:

    Terminal window
    docker exec -it myapp-needs-valkey valkey-cli CONFIG SET requirepass "new-password"

  3. Generate a new seed:

    Terminal window
    openssl rand -hex 32 > /data/password_seed

  4. Restart Holden:

    Terminal window
    docker restart holden

Apps will reconnect with the new derived passwords.