oz0 server master-key confirm-backup
Usage and flags for oz0 server master-key confirm-backup.
For: Operators and developers looking up a command.
Record that you made the offline copy of the master key that server init asks for: if the key is lost, the cluster's CAs, every secret and every payload key are lost with it, and encrypted histories can never be read again, whichever Temporal holds them. Copy the key file somewhere offline and apart from the database's backups first.
This checks that the key unseals the cluster and records who confirmed it, when, and a check value derived from the key (an HMAC, from which the key cannot be found), never the key; oz0 doctor warns until it is done. Run it on a server's machine, with the key file the servers use.
Usage
oz0 server master-key confirm-backup [flags]
Flags
| Flag | Type | Default | Description |
|---|---|---|---|
--data-dir | string | ~/.local/share/orchestrator-zero | server data directory |
--db-file | file | a file (- for stdin) holding the PostgreSQL URL of the management database, such as postgres://oz0:PASSWORD@db:5432/oz0 (or set OZ0_DB); the URL can carry a password, so it never goes on the command line | |
--dev | bool | a dev server's data directory (--data-dir) instead of a cluster's database | |
--master-key-command | command | a command that unwraps the master key from --master-key-file when the file holds it wrapped, such as with an HSM or a KMS: "COMMAND unwrap" prints the key from the wrapped document on stdin, "COMMAND wrap" wraps one, "COMMAND describe" says what holds the wrapping key (see the docs on key commands) (or set OZ0_MASTER_KEY_COMMAND) | |
--master-key-file | string | the master key file the servers use (with --dev: <data-dir>/master.key) | |
--note | string | where the copy is kept, such as the safe's name: one line, kept in the audit log; never the key |
Inherited flags
| Flag | Type | Default | Description |
|---|---|---|---|
--context | string | $OZ0_CONTEXT or <config dir>/orchestrator-zero/context.json | CLI context file written by server init |
--log-level | string | info | log level: debug, info, warn or error |
See all oz0 commands and the global flags.