mirror of
https://github.com/coder/coder.git
synced 2025-07-12 00:14:10 +00:00
docs: convert alerts to use GitHub Flavored Markdown (GFM) (#16850)
followup to #16761 thanks @lucasmelin ! + thanks: @ethanndickson @Parkreiner @matifali @aqandrew - [x] update snippet - [x] find/replace - [x] spot-check [preview](https://coder.com/docs/@16761-gfm-callouts/admin/templates/managing-templates/schedule) (and others) --------- Co-authored-by: EdwardAngert <17991901+EdwardAngert@users.noreply.github.com> Co-authored-by: M Atif Ali <atif@coder.com>
This commit is contained in:
@ -26,24 +26,27 @@ The following database fields are currently encrypted:
|
||||
|
||||
Additional database fields may be encrypted in the future.
|
||||
|
||||
> Implementation notes: each encrypted database column `$C` has a corresponding
|
||||
> `$C_key_id` column. This column is used to determine which encryption key was
|
||||
> used to encrypt the data. This allows Coder to rotate encryption keys without
|
||||
> invalidating existing tokens, and provides referential integrity for encrypted
|
||||
> data.
|
||||
>
|
||||
> The `$C_key_id` column stores the first 7 bytes of the SHA-256 hash of the
|
||||
> encryption key used to encrypt the data.
|
||||
>
|
||||
> Encryption keys in use are stored in `dbcrypt_keys`. This table stores a
|
||||
> record of all encryption keys that have been used to encrypt data. Active keys
|
||||
> have a null `revoked_key_id` column, and revoked keys have a non-null
|
||||
> `revoked_key_id` column. You cannot revoke a key until you have rotated all
|
||||
> values using that key to a new key.
|
||||
### Implementation notes
|
||||
|
||||
Each encrypted database column `$C` has a corresponding
|
||||
`$C_key_id` column. This column is used to determine which encryption key was
|
||||
used to encrypt the data. This allows Coder to rotate encryption keys without
|
||||
invalidating existing tokens, and provides referential integrity for encrypted
|
||||
data.
|
||||
|
||||
The `$C_key_id` column stores the first 7 bytes of the SHA-256 hash of the
|
||||
encryption key used to encrypt the data.
|
||||
|
||||
Encryption keys in use are stored in `dbcrypt_keys`. This table stores a
|
||||
record of all encryption keys that have been used to encrypt data. Active keys
|
||||
have a null `revoked_key_id` column, and revoked keys have a non-null
|
||||
`revoked_key_id` column. You cannot revoke a key until you have rotated all
|
||||
values using that key to a new key.
|
||||
|
||||
## Enabling encryption
|
||||
|
||||
> NOTE: Enabling encryption does not encrypt all existing data. To encrypt
|
||||
> [!NOTE]
|
||||
> Enabling encryption does not encrypt all existing data. To encrypt
|
||||
> existing data, see [rotating keys](#rotating-keys) below.
|
||||
|
||||
- Ensure you have a valid backup of your database. **Do not skip this step.** If
|
||||
@ -115,7 +118,8 @@ data:
|
||||
This command will re-encrypt all tokens with the specified new encryption key.
|
||||
We recommend performing this action during a maintenance window.
|
||||
|
||||
> Note: this command requires direct access to the database. If you are using
|
||||
> [!IMPORTANT]
|
||||
> This command requires direct access to the database. If you are using
|
||||
> the built-in PostgreSQL database, you can run
|
||||
> [`coder server postgres-builtin-url`](../../reference/cli/server_postgres-builtin-url.md)
|
||||
> to get the connection URL.
|
||||
@ -138,7 +142,8 @@ To disable encryption, perform the following actions:
|
||||
This command will decrypt all encrypted user tokens and revoke all active
|
||||
encryption keys.
|
||||
|
||||
> Note: for `decrypt` command, the equivalent environment variable for
|
||||
> [!NOTE]
|
||||
> for `decrypt` command, the equivalent environment variable for
|
||||
> `--keys` is `CODER_EXTERNAL_TOKEN_ENCRYPTION_DECRYPT_KEYS` and not
|
||||
> `CODER_EXTERNAL_TOKEN_ENCRYPTION_KEYS`. This is explicitly named differently
|
||||
> to help prevent accidentally decrypting data.
|
||||
@ -152,7 +157,8 @@ To disable encryption, perform the following actions:
|
||||
|
||||
## Deleting Encrypted Data
|
||||
|
||||
> NOTE: This is a destructive operation.
|
||||
> [!CAUTION]
|
||||
> This is a destructive operation.
|
||||
|
||||
To delete all encrypted data from your database, perform the following actions:
|
||||
|
||||
|
Reference in New Issue
Block a user