Skip to content
LabPod LabPod LabPod Docs

Secret rotation

JWT signing secret

Section titled “JWT signing secret”

The LABPOD_JWT_SECRET in /etc/labpod/labpod.env is the server’s session signing key. Every active user session is invalidated when this secret is rotated - everyone is logged out.

Rotate it during a quiet window:

Terminal window
NEW_SECRET=$(openssl rand -hex 32)
sudo sed -i "s/^LABPOD_JWT_SECRET=.*/LABPOD_JWT_SECRET=$NEW_SECRET/" /etc/labpod/labpod.env
sudo systemctl restart labpod
Terminal window
# Run these as root
NEW_SECRET=$(openssl rand -hex 32)
sed -i "s/^LABPOD_JWT_SECRET=.*/LABPOD_JWT_SECRET=$NEW_SECRET/" /etc/labpod/labpod.env
systemctl restart labpod

After the restart, users must log in again. Running workspaces are unaffected - containers keep running; only the browser sessions are invalidated.

Root admin password

Section titled “Root admin password”

The LabPod root account password (the one you use to log in at http://…:24680) is stored in the LabPod database, not on the Linux system. Rotating it does not touch the host root Linux account.

Terminal window
sudo labpod admin --db /var/lib/labpod/labpod.db set-password root
# You will be prompted for the new password.


# Or non-interactively:
printf '%s\n' 'new-password' | sudo labpod admin --db /var/lib/labpod/labpod.db set-password root
Terminal window
# Run these as root
labpod admin --db /var/lib/labpod/labpod.db set-password root
# You will be prompted for the new password.


# Or non-interactively:
printf '%s\n' 'new-password' | labpod admin --db /var/lib/labpod/labpod.db set-password root

The same command works for any user account:

Terminal window
sudo labpod admin --db /var/lib/labpod/labpod.db set-password alice
Terminal window
# Run these as root
labpod admin --db /var/lib/labpod/labpod.db set-password alice

This always rotates the LabPod password only; the Linux password is never touched.