@@ -7,7 +7,7 @@ preventing attackers with database access from using them to impersonate users.
77##How it works
88
99Coder allows administrators to specify
10- [ external token encryption keys] ( ../cli/server.md#external-token-encryption-keys ) .
10+ [ external token encryption keys] ( ../reference/ cli/server.md#external-token-encryption-keys ) .
1111If configured, Coder will use these keys to encrypt external user tokens before
1212storing them in the database. The encryption algorithm used is AES-256-GCM with
1313a 32-byte key length.
@@ -47,7 +47,7 @@ Additional database fields may be encrypted in the future.
4747
4848- Ensure you have a valid backup of your database.** Do not skip this step.** If
4949 you are using the built-in PostgreSQL database, you can run
50- [ ` coder server postgres-builtin-url ` ] ( ../cli/server_postgres-builtin-url.md )
50+ [ ` coder server postgres-builtin-url ` ] ( ../reference/ cli/server_postgres-builtin-url.md )
5151 to get the connection URL.
5252
5353- Generate a 32-byte random key and base64-encode it. For example:
@@ -90,7 +90,7 @@ if you need to rotate keys, you can perform the following procedure:
9090- Generate a new encryption key following the same procedure as above.
9191
9292- Add the above key to the list of
93- [external token encryption keys](../cli/server.md#--external-token-encryption-keys).
93+ [external token encryption keys](../reference/ cli/server.md#--external-token-encryption-keys).
9494 **The new key must appear first in the list**. For example, in the Kubernetes
9595 secret created above:
9696
@@ -110,13 +110,13 @@ data:
110110 encrypted with the old key(s).
111111
112112- To re-encrypt all encrypted database fields with the new key, run
113- [` coder server dbcrypt rotate`](../cli/server_dbcrypt_rotate.md). This command
114- will re-encrypt all tokens with the specified new encryption key. We recommend
115- performing this action during a maintenance window.
113+ [` coder server dbcrypt rotate`](../reference/ cli/server_dbcrypt_rotate.md).
114+ This command will re-encrypt all tokens with the specified new encryption key.
115+ We recommend performing this action during a maintenance window.
116116
117117> Note: this command requires direct access to the database. If you are using
118118> the built-in PostgreSQL database, you can run
119- > [`coder server postgres-builtin-url`](../cli/server_postgres-builtin-url.md)
119+ > [`coder server postgres-builtin-url`](../reference/ cli/server_postgres-builtin-url.md)
120120> to get the connection URL.
121121
122122-Once the above command completes successfully, remove the old encryption key
@@ -132,8 +132,9 @@ To disable encryption, perform the following actions:
132132-Stop all active coderd instances. This will prevent new encrypted data from
133133being written, which may cause the next step to fail.
134134
135- -Run [`coder server dbcrypt decrypt`](../cli/server_dbcrypt_decrypt.md). This
136- command will decrypt all encrypted user tokens and revoke all active
135+ -Run
136+ [`coder server dbcrypt decrypt`](../reference/cli/server_dbcrypt_decrypt.md).
137+ This command will decrypt all encrypted user tokens and revoke all active
137138encryption keys.
138139
139140> Note: for `decrypt` command, the equivalent environment variable for
@@ -142,7 +143,7 @@ To disable encryption, perform the following actions:
142143> to help prevent accidentally decrypting data.
143144
144145-Remove all
145- [external token encryption keys](../cli/server.md#--external-token-encryption-keys)
146+ [external token encryption keys](../reference/ cli/server.md#--external-token-encryption-keys)
146147from Coder's configuration.
147148
148149-Start coderd. You can now safely delete the encryption keys from your secret
@@ -159,12 +160,13 @@ To delete all encrypted data from your database, perform the following actions:
159160-Stop all active coderd instances. This will prevent new encrypted data from
160161being written.
161162
162- -Run [`coder server dbcrypt delete`](../cli/server_dbcrypt_delete.md). This
163- command will delete all encrypted user tokens and revoke all active encryption
164- keys.
163+ -Run
164+ [`coder server dbcrypt delete`](../reference/cli/server_dbcrypt_delete.md).
165+ This command will delete all encrypted user tokens and revoke all active
166+ encryption keys.
165167
166168-Remove all
167- [external token encryption keys](../cli/server.md#--external-token-encryption-keys)
169+ [external token encryption keys](../reference/ cli/server.md#--external-token-encryption-keys)
168170from Coder's configuration.
169171
170172-Start coderd. You can now safely delete the encryption keys from your secret