chore(hermes): remove the Google OAuth client secret #722

Merged

binjovi-bot merged 1 commit from chore/remove-hermes-google-client into trunk 2026-09-13 17:58:18 +00:00

Conversation 0 Commits 1 Files changed 1 -18

sean commented 2026-09-13 17:56:13 +00:00

Owner

Copy link

secrets/hermes-google-client.yaml.enc holds the SOPS-encrypted client_id and
client_secret of the Google OAuth application Hermes used to read Gmail.

It is the second half of the Gmail credential. gmail.yaml.enc held the
refresh token and went with the service source in #717; this is the OAuth client
that issued it.

Nothing references this file. It is in no kustomization, and no script or
Makefile target reads it -- unlike its neighbours hcloud-token.yaml.enc and
codeberg-token.yaml.enc, which the Makefile decrypts by name.

Why the first sweep missed it

That search grepped file contents for hermes. A SOPS ciphertext does not
contain the word anywhere; only the filename does. It surfaced on a final
git ls-tree pass over trunk. Worth remembering that encrypted files are
invisible to a content grep.

What this does not do

Removing the file does not delete the OAuth client itself, which still exists in
Google Cloud project seanio. The grant it issued is revoked -- the refresh
token was revoked at Google before any of the teardown, and a refresh now
answers invalid_grant / Token has been expired or revoked. Deleting the client
registration is a console action.

https://claude.ai/code/session_01GfkEuwuvGSqGyXVuxwT7PA

`secrets/hermes-google-client.yaml.enc` holds the SOPS-encrypted `client_id` and `client_secret` of the Google OAuth application Hermes used to read Gmail. It is the **second half of the Gmail credential**. `gmail.yaml.enc` held the refresh token and went with the service source in #717; this is the OAuth client that issued it. Nothing references this file. It is in no kustomization, and no script or Makefile target reads it -- unlike its neighbours `hcloud-token.yaml.enc` and `codeberg-token.yaml.enc`, which the Makefile decrypts by name. ### Why the first sweep missed it That search grepped file *contents* for `hermes`. A SOPS ciphertext does not contain the word anywhere; only the filename does. It surfaced on a final `git ls-tree` pass over trunk. Worth remembering that encrypted files are invisible to a content grep. ### What this does not do Removing the file does not delete the OAuth client itself, which still exists in Google Cloud project `seanio`. The grant it issued **is** revoked -- the refresh token was revoked at Google before any of the teardown, and a refresh now answers `invalid_grant / Token has been expired or revoked`. Deleting the client registration is a console action. https://claude.ai/code/session_01GfkEuwuvGSqGyXVuxwT7PA

sean added 1 commit 2026-09-13 17:56:13 +00:00

chore(hermes): remove the Google OAuth client secret ... 85a649d758

secrets/hermes-google-client.yaml.enc holds the SOPS-encrypted client_id
and client_secret of the Google OAuth application that Hermes used to
read Gmail. It is the second half of the Gmail credential: gmail.yaml.enc
held the refresh token and went with the service source.

Nothing references this file. It is not in any kustomization and no
script or Makefile target reads it, unlike its neighbours
hcloud-token.yaml.enc and codeberg-token.yaml.enc.

The earlier sweep missed it. That search grepped file contents for
hermes, and a SOPS ciphertext does not contain the word; only the
filename does.

Removing the file does not delete the OAuth client itself, which still
exists in Google Cloud project seanio. The grant it issued is revoked:
the refresh token was revoked at Google before any of this, and a
refresh answers invalid_grant.

Claude-Session: https://claude.ai/code/session_01GfkEuwuvGSqGyXVuxwT7PA

binjovi-bot merged commit 85a649d758 into trunk 2026-09-13 17:58:18 +00:00

binjovi-bot deleted branch chore/remove-hermes-google-client 2026-09-13 17:58:18 +00:00

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

sean/seanfarm!722

No description provided.