mirror of
https://github.com/coder/coder.git
synced 2026-09-24 15:04:27 +08:00
docs: convert alerts to use GitHub Flavored Markdown (GFM) (#16850)
followup to #16761 thanks @lucasmelin ! + thanks: @ethanndickson @Parkreiner @matifali @aqandrew - [x] update snippet - [x] find/replace - [x] spot-check [preview](https://coder.com/docs/@16761-gfm-callouts/admin/templates/managing-templates/schedule) (and others) --------- Co-authored-by: EdwardAngert <17991901+EdwardAngert@users.noreply.github.com> Co-authored-by: M Atif Ali <atif@coder.com>
This commit is contained in:
co-authored by
EdwardAngert
M Atif Ali
parent
e817713dc0
commit
101b62dc3e
@@ -42,7 +42,8 @@ failed to check whether the API key corresponds to a deleted user.
|
||||
|
||||
## Indications of Compromise
|
||||
|
||||
> 💡 Automated remediation steps in the upgrade purge all affected API keys.
|
||||
> [!TIP]
|
||||
> Automated remediation steps in the upgrade purge all affected API keys.
|
||||
> Either perform the following query before upgrade or run it on a backup of
|
||||
> your database from before the upgrade.
|
||||
|
||||
@@ -81,7 +82,8 @@ Otherwise, the following information will be reported:
|
||||
- User API key ID
|
||||
- Time the affected API key was last used
|
||||
|
||||
> 💡 If your license includes the
|
||||
> [!TIP]
|
||||
> If your license includes the
|
||||
> [Audit Logs](https://coder.com/docs/admin/audit-logs#filtering-logs) feature,
|
||||
> you can then query all actions performed by the above users by using the
|
||||
> filter `email:$USER_EMAIL`.
|
||||
|
||||
@@ -26,24 +26,27 @@ The following database fields are currently encrypted:
|
||||
|
||||
Additional database fields may be encrypted in the future.
|
||||
|
||||
> Implementation notes: each encrypted database column `$C` has a corresponding
|
||||
> `$C_key_id` column. This column is used to determine which encryption key was
|
||||
> used to encrypt the data. This allows Coder to rotate encryption keys without
|
||||
> invalidating existing tokens, and provides referential integrity for encrypted
|
||||
> data.
|
||||
>
|
||||
> The `$C_key_id` column stores the first 7 bytes of the SHA-256 hash of the
|
||||
> encryption key used to encrypt the data.
|
||||
>
|
||||
> Encryption keys in use are stored in `dbcrypt_keys`. This table stores a
|
||||
> record of all encryption keys that have been used to encrypt data. Active keys
|
||||
> have a null `revoked_key_id` column, and revoked keys have a non-null
|
||||
> `revoked_key_id` column. You cannot revoke a key until you have rotated all
|
||||
> values using that key to a new key.
|
||||
### Implementation notes
|
||||
|
||||
Each encrypted database column `$C` has a corresponding
|
||||
`$C_key_id` column. This column is used to determine which encryption key was
|
||||
used to encrypt the data. This allows Coder to rotate encryption keys without
|
||||
invalidating existing tokens, and provides referential integrity for encrypted
|
||||
data.
|
||||
|
||||
The `$C_key_id` column stores the first 7 bytes of the SHA-256 hash of the
|
||||
encryption key used to encrypt the data.
|
||||
|
||||
Encryption keys in use are stored in `dbcrypt_keys`. This table stores a
|
||||
record of all encryption keys that have been used to encrypt data. Active keys
|
||||
have a null `revoked_key_id` column, and revoked keys have a non-null
|
||||
`revoked_key_id` column. You cannot revoke a key until you have rotated all
|
||||
values using that key to a new key.
|
||||
|
||||
## Enabling encryption
|
||||
|
||||
> NOTE: Enabling encryption does not encrypt all existing data. To encrypt
|
||||
> [!NOTE]
|
||||
> Enabling encryption does not encrypt all existing data. To encrypt
|
||||
> existing data, see [rotating keys](#rotating-keys) below.
|
||||
|
||||
- Ensure you have a valid backup of your database. **Do not skip this step.** If
|
||||
@@ -115,7 +118,8 @@ data:
|
||||
This command will re-encrypt all tokens with the specified new encryption key.
|
||||
We recommend performing this action during a maintenance window.
|
||||
|
||||
> Note: this command requires direct access to the database. If you are using
|
||||
> [!IMPORTANT]
|
||||
> This command requires direct access to the database. If you are using
|
||||
> the built-in PostgreSQL database, you can run
|
||||
> [`coder server postgres-builtin-url`](../../reference/cli/server_postgres-builtin-url.md)
|
||||
> to get the connection URL.
|
||||
@@ -138,7 +142,8 @@ To disable encryption, perform the following actions:
|
||||
This command will decrypt all encrypted user tokens and revoke all active
|
||||
encryption keys.
|
||||
|
||||
> Note: for `decrypt` command, the equivalent environment variable for
|
||||
> [!NOTE]
|
||||
> for `decrypt` command, the equivalent environment variable for
|
||||
> `--keys` is `CODER_EXTERNAL_TOKEN_ENCRYPTION_DECRYPT_KEYS` and not
|
||||
> `CODER_EXTERNAL_TOKEN_ENCRYPTION_KEYS`. This is explicitly named differently
|
||||
> to help prevent accidentally decrypting data.
|
||||
@@ -152,7 +157,8 @@ To disable encryption, perform the following actions:
|
||||
|
||||
## Deleting Encrypted Data
|
||||
|
||||
> NOTE: This is a destructive operation.
|
||||
> [!CAUTION]
|
||||
> This is a destructive operation.
|
||||
|
||||
To delete all encrypted data from your database, perform the following actions:
|
||||
|
||||
|
||||
@@ -7,6 +7,7 @@ For other security tips, visit our guide to
|
||||
|
||||
## Security Advisories
|
||||
|
||||
> [!CAUTION]
|
||||
> If you discover a vulnerability in Coder, please do not hesitate to report it
|
||||
> to us by following the instructions
|
||||
> [here](https://github.com/coder/coder/blob/main/SECURITY.md).
|
||||
|
||||
@@ -38,7 +38,8 @@ Users can view their public key in their account settings:
|
||||
|
||||

|
||||
|
||||
> Note: SSH keys are never stored in Coder workspaces, and are fetched only when
|
||||
> [!NOTE]
|
||||
> SSH keys are never stored in Coder workspaces, and are fetched only when
|
||||
> SSH is invoked. The keys are held in-memory and never written to disk.
|
||||
|
||||
## Dynamic Secrets
|
||||
|
||||
Reference in New Issue
Block a user