feat(coderd): plumb through dbcrypt package #9433
Conversation
- Adds a command dbcrypt-rotate to re-enncrypt encrypted data - Plumbs through dbcrypt in enterprise/coderd (including unit tests) - Enables database encryption in develop.sh by default Co-authored-by: Kyle Carberry <kyle@coder.com>
| return xerrors.Errorf("get users: %w", err) | ||
| } | ||
| for idx, usr := range users { | ||
| userLinks, err := cryptDB.GetUserLinksByUserID(ctx, usr.ID) |
There was a problem hiding this comment.
Should put comments everywhere so people forget to add something in one place and forget it here.
| database. The value must be a comma-separated list of base64-encoded | ||
| keys. A maximum of two keys may be provided. Each key, when | ||
| base64-decoded, must be exactly 32 bytes in length. The first key will | ||
| be used to encrypt new values. Subsequent keys will be used as a |
There was a problem hiding this comment.
It seems a little confusing that there's a maximum of two keys but this refers to "subsequent keys". Maybe it should say "the optional second key" instead?
There was a problem hiding this comment.
Based on other comments, I'm considering removing the restriction on the number of keys. I can see a legitimate use case for needing to have three keys for a period of time.
| opts = vals.Options() | ||
| ) | ||
| cmd := &clibase.Cmd{ | ||
| Use: "dbcrypt-rotate --postgres-url <postgres_url> --external-token-encryption-keys <new-key>,<old-key>", |
There was a problem hiding this comment.
running this from the CLI that has to have direct DB access is kind of obnoxious from an operator's standpoint.
What about making it an API call you could make to an appropriately-keyed Coderd? We could still have the CLI command, but you could run it from anywhere with Coder access. We could also consider a button on the front end at some later date.
There was a problem hiding this comment.
While this would be a nice usability improvement, it has precedence already with the reset-password CLI command. It's a good candidate for a follow-up PR though!
|
Closing in favour of #9523 |
See #9523 instead.
This commit builds upon #9421. It is recommended to read this first.
dbcrypt-rotateto re-enncrypt encrypted datadbcryptinenterprise/coderd(including unit tests)develop.shby defaultadmin/encryption.md