oz0 server secrets-key unwrap-to-file
Usage and flags for oz0 server secrets-key unwrap-to-file.
For: Operators and developers looking up a command.
The way out of a key command: unwrap the secrets key once more with COMMAND unwrap and write it as a plain key file, mode 0600, in place of the wrapped one (kept as <file>.wrapped), or at --out, which must not exist. Servers then start without --secrets-key-command, so the command, and whatever holds its wrapping key, can be taken away. It needs only COMMAND unwrap, and no licence.
With --db-file, OZ0_DB or --dev it checks the key against the cluster and writes an audit entry.
Usage
oz0 server secrets-key unwrap-to-file --command COMMAND [flags]
Flags
| Flag | Type | Default | Description |
|---|---|---|---|
--command | command | the key command that unwraps the file | |
--data-dir | string | ~/.local/share/orchestrator-zero | server data directory |
--db-file | file | a file (- for stdin) holding the PostgreSQL URL of the management database, such as postgres://oz0:PASSWORD@db:5432/oz0 (or set OZ0_DB); the URL can carry a password, so it never goes on the command line | |
--dev | bool | a dev server's data directory (--data-dir) instead of a cluster's database | |
--out | string | write the plain key file here instead of in place of the wrapped one | |
--secrets-key-file | string | the secrets key file the edges start with (--secrets-key-file of server start) |
Inherited flags
| Flag | Type | Default | Description |
|---|---|---|---|
--context | string | $OZ0_CONTEXT or <config dir>/orchestrator-zero/context.json | CLI context file written by server init |
--log-level | string | info | log level: debug, info, warn or error |
See all oz0 commands and the global flags.