mix ankusa.secrets.rewrap (ankusa v0.7.0)

Copy Markdown View Source

Moves every API-managed source a node stored in its own Ankusa.Store (Ankusa.SourceStore.Persistent) to the current key-encryption key: rows written before a KEK existed are encrypted, and rows encrypted under a kek_previous key are rewritten under the current one. Afterwards the old key can be dropped from secrets.kek_previous.

mix ankusa.secrets.rewrap --dry-run
mix ankusa.secrets.rewrap --data-dir /var/lib/ankusa --instance default

The store is <data-dir>/<instance>/store. Without --dry-run the task opens the store, so stop the node that owns it first (a running node rewraps with Ankusa.SourceStore.Persistent.rewrap/1; sources in Redis with Ankusa.SourceStore.Redis.rewrap/1).

The keys come from the environment, never the command line:

  • ANKUSA_KEK — the current key ("<base64>" or "<id>:<base64>")
  • ANKUSA_KEK_PREVIOUS — comma-separated keys that may still decrypt

or, when ANKUSA_KEK is unset, from config :ankusa, :secrets (the same map as Ankusa.Config's secrets). A row no key opens stops the task and is reported; nothing is written for the rows after it.

Options:

  • --dry-run — count what would be rewritten, change nothing
  • --data-dir — default config :ankusa, :data_dir (./data)
  • --instance — default default