()
| 37 | } |
| 38 | |
| 39 | func (*RootCmd) dbcryptRotateCmd() *serpent.Command { |
| 40 | var flags rotateFlags |
| 41 | cmd := &serpent.Command{ |
| 42 | Use: "rotate", |
| 43 | Short: "Rotate database encryption keys.", |
| 44 | Handler: func(inv *serpent.Invocation) error { |
| 45 | ctx, cancel := context.WithCancel(inv.Context()) |
| 46 | defer cancel() |
| 47 | logger := slog.Make(sloghuman.Sink(inv.Stdout)) |
| 48 | if ok, _ := inv.ParsedFlags().GetBool("verbose"); ok { |
| 49 | logger = logger.Leveled(slog.LevelDebug) |
| 50 | } |
| 51 | |
| 52 | if err := flags.valid(); err != nil { |
| 53 | return err |
| 54 | } |
| 55 | |
| 56 | ks := [][]byte{} |
| 57 | dk, err := base64.StdEncoding.DecodeString(flags.New) |
| 58 | if err != nil { |
| 59 | return xerrors.Errorf("decode new key: %w", err) |
| 60 | } |
| 61 | ks = append(ks, dk) |
| 62 | |
| 63 | for _, k := range flags.Old { |
| 64 | dk, err := base64.StdEncoding.DecodeString(k) |
| 65 | if err != nil { |
| 66 | return xerrors.Errorf("decode old key: %w", err) |
| 67 | } |
| 68 | ks = append(ks, dk) |
| 69 | } |
| 70 | |
| 71 | ciphers, err := dbcrypt.NewCiphers(ks...) |
| 72 | if err != nil { |
| 73 | return xerrors.Errorf("create ciphers: %w", err) |
| 74 | } |
| 75 | |
| 76 | var act string |
| 77 | switch len(flags.Old) { |
| 78 | case 0: |
| 79 | act = "Data will be encrypted with the new key." |
| 80 | default: |
| 81 | act = "Data will be decrypted with all available keys and re-encrypted with new key." |
| 82 | } |
| 83 | |
| 84 | msg := fmt.Sprintf("%s\n\n- New key: %s\n- Old keys: %s\n\nRotate external token encryption keys?\n", |
| 85 | act, |
| 86 | flags.New, |
| 87 | strings.Join(flags.Old, ", "), |
| 88 | ) |
| 89 | if _, err := cliui.Prompt(inv, cliui.PromptOptions{Text: msg, IsConfirm: true}); err != nil { |
| 90 | return err |
| 91 | } |
| 92 | |
| 93 | sqlDriver := "postgres" |
| 94 | if codersdk.PostgresAuth(flags.PostgresAuth) == codersdk.PostgresAuthAWSIAMRDS { |
| 95 | sqlDriver, err = awsiamrds.Register(inv.Context(), sqlDriver) |
| 96 | if err != nil { |
no test coverage detected