Back up and rotate keys

Back up

A server's vaults are read with two things together, and with neither alone:

  • The master key in VAULT_HOSTED_MASTER_KEY. Keep it outside the bucket and outside the server's machine.
  • hosted.sqlite under VAULT_AUTH_DIR (/data/auth in the image), which holds every vault's key sealed by the master key, and the accounts, ways in, hashed keys and tokens, and registered clients.

Back up the vaults' storage as well: the folder in VAULT_PATH or the bucket. The search indexes under VAULT_CACHE_DIR are rebuilt from the vaults and need no backup.

Each person can also download a personal vault as a zip from its page at any time.

Rotate the master key

  1. Make a new key with mindin master-key generate.

  2. Set the new key in VAULT_HOSTED_MASTER_KEY and the old one in VAULT_HOSTED_MASTER_KEY_PREVIOUS, and restart the server.

  3. Wrap every vault key under the new one:

    mindin master-key rewrap
mindin master-key status    # vault keys per master key

  4. When status counts no vault key under the old key, remove VAULT_HOSTED_MASTER_KEY_PREVIOUS and restart.

VAULT_HOSTED_MASTER_KEY_PREVIOUS takes several keys, space or comma separated.