feat(tamanu): print the config key path for backup defs - #830
Conversation
39b640d to
c113992
Compare
|
Hmmm I would prefer a special "tamanu secret key" backup method which does the right thing per platform. That way when seedling lands it can start also doing the right thing, and it might be able to be clever enough in future to convert a windows secret to a linux secret to a seedling secret. |
|
|
||
| Where the key lives is a property of the install, not of the definition, so the method resolves it rather than having an operator name a path per host. | ||
| A bare-metal or Windows install points `crypto.keyFile` at a file, relative paths resolving against the server package directory as they do for the server itself. | ||
| A containerised install takes the key as a podman secret and has no server-side path, so podman's secret store is captured whole instead — the store holds every secret on the host, and podman owns its layout. |
There was a problem hiding this comment.
Well, hold on, couldn't bestool ask the podman API for the secret value and back that up as a file? There might be unrelated secrets in the full store, or even values that are genuinely proper to the host and shouldn't be restored. And a single secret value is migratable, while a podman store as a blob isn't.
| It is not offered as a rollback point: re-capturing a key costs nothing, so there is nothing a hold would buy. | ||
|
|
||
| A restore lays the captured shape back where this host keeps it, keeping any key it displaces beside it. | ||
| Restoring one shape onto a host that wants the other is refused rather than converted: turning a Windows key file into a podman secret is a real transformation, and a half-right one leaves a server that starts and reads none of its secrets. |
There was a problem hiding this comment.
Restoring one shape into another is a property I explicitly said we wanted, though?
2 participants
Tamanu 2.60+ encrypts every
local_system_secretsvalue (the settings PSK and so every secret setting, the device key, a facility's sync password) with a per-server key. No backup captures that key today, so a database restored onto another host reads none of them: a clone comes up with its sync user locked out, and a rebuilt host loses its secrets outright.bestool tamanu config-key-pathprints the resolvedcrypto.keyFile, so a backup def can name it aspath_commandand capture the key with the database it belongs to.