feat(coderd): plumb through dbcrypt package #9433
Next
Next commit
plumb through dbcrypt in enterprise/coderd:
- Adds a command dbcrypt-rotate to re-enncrypt encrypted data - Plumbs through dbcrypt in enterprise/coderd (including unit tests) - Enables database encryption in develop.sh by default Co-authored-by: Kyle Carberry <kyle@coder.com>
- Loading branch information
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,131 @@ | ||
| //go:build !slim | ||
|
|
||
| package cli | ||
|
|
||
| import ( | ||
| "bytes" | ||
| "context" | ||
| "encoding/base64" | ||
|
|
||
| "cdr.dev/slog" | ||
| "cdr.dev/slog/sloggers/sloghuman" | ||
|
|
||
| "github.com/coder/coder/v2/cli" | ||
| "github.com/coder/coder/v2/cli/clibase" | ||
| "github.com/coder/coder/v2/coderd/database" | ||
| "github.com/coder/coder/v2/codersdk" | ||
| "github.com/coder/coder/v2/enterprise/dbcrypt" | ||
|
|
||
| "golang.org/x/xerrors" | ||
| ) | ||
|
|
||
| func (*RootCmd) dbcryptRotate() *clibase.Cmd { | ||
| var ( | ||
| vals = new(codersdk.DeploymentValues) | ||
| opts = vals.Options() | ||
| ) | ||
| cmd := &clibase.Cmd{ | ||
| Use: "dbcrypt-rotate --postgres-url <postgres_url> --external-token-encryption-keys <new-key>,<old-key>", | ||
|
There was a problem hiding this comment. running this from the CLI that has to have direct DB access is kind of obnoxious from an operator's standpoint. What about making it an API call you could make to an appropriately-keyed Coderd? We could still have the CLI command, but you could run it from anywhere with Coder access. We could also consider a button on the front end at some later date. There was a problem hiding this comment. While this would be a nice usability improvement, it has precedence already with the |
||
| Short: "Rotate database encryption keys", | ||
| Options: clibase.OptionSet{ | ||
| *opts.ByName("Postgres Connection URL"), | ||
| *opts.ByName("External Token Encryption Keys"), | ||
| }, | ||
| Middleware: clibase.Chain( | ||
| clibase.RequireNArgs(0), | ||
| ), | ||
| Handler: func(inv *clibase.Invocation) error { | ||
| ctx, cancel := context.WithCancel(inv.Context()) | ||
| defer cancel() | ||
| logger := slog.Make(sloghuman.Sink(inv.Stdout)) | ||
|
|
||
| if vals.PostgresURL == "" { | ||
| return xerrors.Errorf("no database configured") | ||
| } | ||
|
|
||
| if vals.ExternalTokenEncryptionKeys == nil || len(vals.ExternalTokenEncryptionKeys) != 2 { | ||
johnstcn marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| return xerrors.Errorf("dbcrypt-rotate requires exactly two external token encryption keys") | ||
| } | ||
|
|
||
| newKey, err := base64.StdEncoding.DecodeString(vals.ExternalTokenEncryptionKeys[0]) | ||
| if err != nil { | ||
| return xerrors.Errorf("new key must be base64-encoded") | ||
| } | ||
| oldKey, err := base64.StdEncoding.DecodeString(vals.ExternalTokenEncryptionKeys[1]) | ||
| if err != nil { | ||
| return xerrors.Errorf("old key must be base64-encoded") | ||
| } | ||
| if bytes.Equal(newKey, oldKey) { | ||
| return xerrors.Errorf("old and new keys must be different") | ||
| } | ||
|
|
||
| primaryCipher, err := dbcrypt.CipherAES256(newKey) | ||
| if err != nil { | ||
| return xerrors.Errorf("create primary cipher: %w", err) | ||
| } | ||
| secondaryCipher, err := dbcrypt.CipherAES256(oldKey) | ||
| if err != nil { | ||
| return xerrors.Errorf("create secondary cipher: %w", err) | ||
| } | ||
| ciphers := dbcrypt.NewCiphers(primaryCipher, secondaryCipher) | ||
|
|
||
| sqlDB, err := cli.ConnectToPostgres(inv.Context(), logger, "postgres", vals.PostgresURL.Value()) | ||
| if err != nil { | ||
| return xerrors.Errorf("connect to postgres: %w", err) | ||
| } | ||
| defer func() { | ||
| _ = sqlDB.Close() | ||
| }() | ||
| logger.Info(ctx, "connected to postgres") | ||
|
|
||
| db := database.New(sqlDB) | ||
|
|
||
| cryptDB, err := dbcrypt.New(ctx, db, ciphers) | ||
| if err != nil { | ||
| return xerrors.Errorf("create cryptdb: %w", err) | ||
| } | ||
|
|
||
| users, err := cryptDB.GetUsers(ctx, database.GetUsersParams{}) | ||
| if err != nil { | ||
| return xerrors.Errorf("get users: %w", err) | ||
| } | ||
| for idx, usr := range users { | ||
| userLinks, err := cryptDB.GetUserLinksByUserID(ctx, usr.ID) | ||
|
There was a problem hiding this comment. Should put comments everywhere so people forget to add something in one place and forget it here. |
||
| if err != nil { | ||
| return xerrors.Errorf("get user links for user: %w", err) | ||
| } | ||
| for _, userLink := range userLinks { | ||
| if _, err := cryptDB.UpdateUserLink(ctx, database.UpdateUserLinkParams{ | ||
johnstcn marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| OAuthAccessToken: userLink.OAuthAccessToken, | ||
| OAuthRefreshToken: userLink.OAuthRefreshToken, | ||
| OAuthExpiry: userLink.OAuthExpiry, | ||
| UserID: usr.ID, | ||
| LoginType: usr.LoginType, | ||
| }); err != nil { | ||
| return xerrors.Errorf("update user link: %w", err) | ||
| } | ||
| } | ||
| gitAuthLinks, err := cryptDB.GetGitAuthLinksByUserID(ctx, usr.ID) | ||
| if err != nil { | ||
| return xerrors.Errorf("get git auth links for user: %w", err) | ||
| } | ||
| for _, gitAuthLink := range gitAuthLinks { | ||
| if _, err := cryptDB.UpdateGitAuthLink(ctx, database.UpdateGitAuthLinkParams{ | ||
| ProviderID: gitAuthLink.ProviderID, | ||
| UserID: usr.ID, | ||
| UpdatedAt: gitAuthLink.UpdatedAt, | ||
| OAuthAccessToken: gitAuthLink.OAuthAccessToken, | ||
| OAuthRefreshToken: gitAuthLink.OAuthRefreshToken, | ||
| OAuthExpiry: gitAuthLink.OAuthExpiry, | ||
| }); err != nil { | ||
| return xerrors.Errorf("update git auth link: %w", err) | ||
| } | ||
| } | ||
| logger.Info(ctx, "encrypted user tokens", slog.F("current", idx+1), slog.F("of", len(users))) | ||
| } | ||
| logger.Info(ctx, "operation completed successfully") | ||
| return nil | ||
| }, | ||
| } | ||
| return cmd | ||
| } | ||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
It seems a little confusing that there's a maximum of two keys but this refers to "subsequent keys". Maybe it should say "the optional second key" instead?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Based on other comments, I'm considering removing the restriction on the number of keys. I can see a legitimate use case for needing to have three keys for a period of time.