feat: implement key rotation system (#14710)

coderd/database/dbgen/dbgen.go

@@ -902,7 +902,11 @@ func CryptoKey(t testing.TB, db database.Store, seed database.CryptoKey) databas
 
 	seed.Feature = takeFirst(seed.Feature, database.CryptoKeyFeatureWorkspaceApps)
 
-	if !seed.Secret.Valid {
+	// An empty string for the secret is interpreted as
+	// a caller wanting a new secret to be generated.
+	// To generate a key with a NULL secret set Valid=false
+	// and String to a non-empty string.
+	if seed.Secret.String == "" {
 		secret, err := newCryptoKeySecret(seed.Feature)
 		require.NoError(t, err, "generate secret")
 		seed.Secret = sql.NullString{

coderd/database/lock.go

@@ -11,6 +11,7 @@ const (
 	LockIDDBRollup
 	LockIDDBPurge
 	LockIDNotificationsReportGenerator
+	LockIDCryptoKeyRotation
 )
 
 // GenLockID generates a unique and consistent lock ID from a given string.