oz0 server secrets-key confirm-backup
Record that you made an offline copy of the secrets key that tenant secrets are sealed to, kept with the master key's: losing it loses every secret sealed to it.
For: Operators and developers looking up a command.
Record that you made an offline copy of the secrets key that tenant secrets are sealed to, kept with the master key's: losing it loses every secret sealed to it. The file's public half must be the one the cluster published. Only that public half is recorded; oz0 doctor warns until it is done, and again when the cluster seals to another key.
Usage
oz0 server secrets-key confirm-backup [flags]
Flags
| Flag | Type | Default | Description |
|---|---|---|---|
--data-dir | string | ~/.local/share/orchestrator-zero | server data directory |
--db-file | file | a file (- for stdin) holding the PostgreSQL URL of the management database, such as postgres://oz0:PASSWORD@db:5432/oz0 (or set OZ0_DB); the URL can carry a password, so it never goes on the command line | |
--dev | bool | a dev server's data directory (--data-dir) instead of a cluster's database | |
--note | string | where the copy is kept: one line, kept in the audit log; never the key | |
--secrets-key-command | command | a command that unwraps the secrets key from --secrets-key-file when the file holds it wrapped: "COMMAND unwrap" prints the key from the wrapped document on stdin, "COMMAND wrap" wraps one, "COMMAND describe" says what holds the wrapping key (see the docs on key commands) (or set OZ0_SECRETS_KEY_COMMAND) | |
--secrets-key-file | string | the secrets key file the edges use (--secrets-key-file of server start) |
Inherited flags
| Flag | Type | Default | Description |
|---|---|---|---|
--context | string | $OZ0_CONTEXT or <config dir>/orchestrator-zero/context.json | CLI context file written by server init |
--log-level | string | info | log level: debug, info, warn or error |
See all oz0 commands and the global flags.