# `mix ankusa.secrets.rewrap`
[🔗](https://github.com/jamescarr/ankusa/blob/ankusa-v0.7.0/packages/ankusa/lib/mix/tasks/ankusa.secrets.rewrap.ex#L1)

Moves every API-managed source a node stored in its own `Ankusa.Store`
(`Ankusa.SourceStore.Persistent`) to the current key-encryption key: rows
written before a KEK existed are encrypted, and rows encrypted under a
`kek_previous` key are rewritten under the current one. Afterwards the old key
can be dropped from `secrets.kek_previous`.

    mix ankusa.secrets.rewrap --dry-run
    mix ankusa.secrets.rewrap --data-dir /var/lib/ankusa --instance default

The store is `<data-dir>/<instance>/store`. Without `--dry-run` the task opens
the store, so stop the node that owns it first (a running node rewraps with
`Ankusa.SourceStore.Persistent.rewrap/1`; sources in Redis with
`Ankusa.SourceStore.Redis.rewrap/1`).

The keys come from the environment, never the command line:

  * `ANKUSA_KEK` — the current key (`"<base64>"` or `"<id>:<base64>"`)
  * `ANKUSA_KEK_PREVIOUS` — comma-separated keys that may still decrypt

or, when `ANKUSA_KEK` is unset, from `config :ankusa, :secrets` (the same map
as `Ankusa.Config`'s `secrets`). A row no key opens stops the task and is
reported; nothing is written for the rows after it.

Options:

  * `--dry-run` — count what would be rewritten, change nothing
  * `--data-dir` — default `config :ankusa, :data_dir` (`./data`)
  * `--instance` — default `default`

---

*Consult [api-reference.md](api-reference.md) for complete listing*