opschain admin encryption
Included from Basic tier
The encryption key lifecycle for the values the server encrypts at rest.
Every stored envelope — the property and settings
documents, sensitive step outputs, Git credentials, identity-provider
client secrets, MFA secrets, secrets/model/SIEM/webhook provider
credentials, notification signing secrets, the dispatch mask set and the
rendered MintModel documents — names the key that sealed it, so a key can
be rotated: add the new key as OPSCHAIN_PRIMARY_KEY, keep the old one in
OPSCHAIN_PREVIOUS_KEYS, re-encrypt, then drop the old key once the
server reports it retired. These verbs run server-side against whichever
store the server runs (PostgreSQL or embedded SQLite).
| Subcommand | Purpose |
|---|---|
status | The census: the configured key ring, the key registry, every encrypted-at-rest column's envelope count per key id, what is pending re-encryption, and the last run — opschain docs cli/admin-encryption-status. |
reencrypt | Rewrite every envelope under the current key: batched, resumable, idempotent, audited by counts; retires the superseded keys once nothing references them — opschain docs cli/admin-encryption-reencrypt. |
A server without encryption keys configured answers both verbs with a
named failed_precondition — nothing is encrypted at rest there.
Vault-held secrets are not in this plane: a secret-vault:// reference
resolves in the vault, whose key rotation is the vault's own job, and the
cipher-stacked {AES2} stored secrets rotate with opschain secret migrate (the transportable key). This family is the database-side
envelope keys only.
Like every admin verb, these authenticate with the admin bearer
(--auth-token, then OPSCHAIN_ADMIN_TOKEN, then the token stored by
opschain admin login) against --server, OPSCHAIN_SERVER or the active
context.
See also
opschain docs storage— the keyset (keys.env), the key reference every envelope carries, and the boot gate every replica enforces.- The encryption key rotation runbook in the operations runbooks — the rotation drill and the evidence it produces.