Secret rotation

JWT signing secret

The LABPOD_JWT_SECRET in /etc/labpod/labpod.env is the server’s session signing key. Every active user session is invalidated when this secret is rotated - everyone is logged out.

Rotate it during a quiet window:

Ubuntu / Debian Rocky / RHEL / AlmaLinux / Fedora

NEW_SECRET=$(openssl rand -hex 32)
sudo sed -i "s/^LABPOD_JWT_SECRET=.*/LABPOD_JWT_SECRET=$NEW_SECRET/" /etc/labpod/labpod.env
sudo systemctl restart labpod

# Run these as root
NEW_SECRET=$(openssl rand -hex 32)
sed -i "s/^LABPOD_JWT_SECRET=.*/LABPOD_JWT_SECRET=$NEW_SECRET/" /etc/labpod/labpod.env
systemctl restart labpod

After the restart, users must log in again. Running workspaces are unaffected - containers keep running; only the browser sessions are invalidated.

Caution

The server refuses to start in production mode if LABPOD_JWT_SECRET is blank or missing. The installer sets it for you on a fresh install; when rotating, just make sure the sed edit above left a non-empty value before you restart.

Root admin password

The LabPod root account password (the one you use to log in at http://…:24680) is stored in the LabPod database, not on the Linux system. Rotating it does not touch the host root Linux account.

Ubuntu / Debian Rocky / RHEL / AlmaLinux / Fedora

sudo labpod admin --db /var/lib/labpod/labpod.db set-password root
# You will be prompted for the new password.

# Or non-interactively:
printf '%s\n' 'new-password' | sudo labpod admin --db /var/lib/labpod/labpod.db set-password root

# Run these as root
labpod admin --db /var/lib/labpod/labpod.db set-password root
# You will be prompted for the new password.

# Or non-interactively:
printf '%s\n' 'new-password' | labpod admin --db /var/lib/labpod/labpod.db set-password root

The same command works for any user account:

Ubuntu / Debian Rocky / RHEL / AlmaLinux / Fedora

sudo labpod admin --db /var/lib/labpod/labpod.db set-password alice

# Run these as root
labpod admin --db /var/lib/labpod/labpod.db set-password alice

This always rotates the LabPod password only; the Linux password is never touched.

Setting a user’s password also revokes all of that user’s active sessions and API tokens (PATs), so they are logged out everywhere and any scripts or CLI tools using their tokens stop working until reissued.