[bruce-y]

Add a detailed operator runbook for rotating passwords across both vprox control servers and enabled relays. It covers singular/plural password semantics, the actual deployed Doppler config, gateway coverage and management access, bind-address lifetime checks, relay session drain, client transition, retirement, and recovery.

Include separate old/new/invalid probes for the control endpoint and the relay handshake. The relay probe verifies the channel-bound server proof. The runbook is self-contained and states that runner hosts must be rolled and outgoing old-key jobs must finish before retirement; it also explains how an excluded gateway can safely return to service.

Validated Bash/Python snippets, relative links, and Go formatting on Blacksmith Testbox; the embedded relay probe compiles against this repository. No production configuration or runtime code changes.

Related service runbooks:

• bazel-remote
• smart-git-proxy

[blacksmith-staging]

Relay probe: new/old ok, invalid refused

The runbook's probe built from the repo and, against a live relay, passed new/old with verified proofs during overlap and rejected old after retirement; mismatched phases exit non-zero.

Also checked · 3 match

Control probe: 400 accepted, 401 rejected
Singular literal, plural trimmed, empty rejected
README and RELAY links resolve

_{Proof on 1f76542f}

View full Proof report