feat(coderd): connect dbcrypt package implementation (#9523)

See also: https://github.com/coder/coder/pull/9522

- Adds commands `server dbcrypt {rotate,decrypt,delete}` to re-encrypt, decrypt, or delete encrypted data, respectively.
- Plumbs through dbcrypt in enterprise/coderd (including unit tests).
- Adds documentation in admin/encryption.md.

This enables dbcrypt by default, but the feature is soft-enforced on supplying external token encryption keys. Without specifying any keys, encryption/decryption is a no-op.

docs/cli/server.md

@@ -15,6 +15,7 @@ coder server [flags]
 | Name                                                                      | Purpose                                                                                                |
 | ------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------ |
 | [<code>create-admin-user</code>](./server_create-admin-user.md)           | Create a new admin user with the given username, email and password and adds it to every organization. |
+| [<code>dbcrypt</code>](./server_dbcrypt.md)                               | Manage database encryption.                                                                            |
 | [<code>postgres-builtin-serve</code>](./server_postgres-builtin-serve.md) | Run the built-in PostgreSQL deployment.                                                                |
 | [<code>postgres-builtin-url</code>](./server_postgres-builtin-url.md)     | Output the connection URL for the built-in PostgreSQL deployment.                                      |
 
@@ -273,6 +274,15 @@ Expose the swagger endpoint via /swagger.
 
 Enable one or more experiments. These are not ready for production. Separate multiple experiments with commas, or enter '\*' to opt-in to all available experiments.
 
+### --external-token-encryption-keys
+
+|             |                                                    |
+| ----------- | -------------------------------------------------- |
+| Type        | <code>string-array</code>                          |
+| Environment | <code>$CODER_EXTERNAL_TOKEN_ENCRYPTION_KEYS</code> |
+
+Encrypt OIDC and Git authentication tokens with AES-256-GCM in the database. The value must be a comma-separated list of base64-encoded keys. Each key, when base64-decoded, must be exactly 32 bytes in length. The first key will be used to encrypt new values. Subsequent keys will be used as a fallback when decrypting. During normal operation it is recommended to only set one key unless you are in the process of rotating keys with the `coder server dbcrypt rotate` command.
+
 ### --provisioner-force-cancel-interval
 
 |             |                                                       |

docs/cli/server_dbcrypt.md

@@ -0,0 +1,19 @@
+<!-- DO NOT EDIT | GENERATED CONTENT -->
+
+# server dbcrypt
+
+Manage database encryption.
+
+## Usage
+
+```console
+coder server dbcrypt
+```
+
+## Subcommands
+
+| Name                                                | Purpose                                                                       |
+| --------------------------------------------------- | ----------------------------------------------------------------------------- |
+| [<code>decrypt</code>](./server_dbcrypt_decrypt.md) | Decrypt a previously encrypted database.                                      |
+| [<code>delete</code>](./server_dbcrypt_delete.md)   | Delete all encrypted data from the database. THIS IS A DESTRUCTIVE OPERATION. |
+| [<code>rotate</code>](./server_dbcrypt_rotate.md)   | Rotate database encryption keys.                                              |

docs/cli/server_dbcrypt_decrypt.md

@@ -0,0 +1,39 @@
+<!-- DO NOT EDIT | GENERATED CONTENT -->
+
+# server dbcrypt decrypt
+
+Decrypt a previously encrypted database.
+
+## Usage
+
+```console
+coder server dbcrypt decrypt [flags]
+```
+
+## Options
+
+### --keys
+
+|             |                                                            |
+| ----------- | ---------------------------------------------------------- |
+| Type        | <code>string-array</code>                                  |
+| Environment | <code>$CODER_EXTERNAL_TOKEN_ENCRYPTION_DECRYPT_KEYS</code> |
+
+Keys required to decrypt existing data. Must be a comma-separated list of base64-encoded keys.
+
+### --postgres-url
+
+|             |                                       |
+| ----------- | ------------------------------------- |
+| Type        | <code>string</code>                   |
+| Environment | <code>$CODER_PG_CONNECTION_URL</code> |
+
+The connection URL for the Postgres database.
+
+### -y, --yes
+
+|      |                   |
+| ---- | ----------------- |
+| Type | <code>bool</code> |
+
+Bypass prompts.

docs/cli/server_dbcrypt_delete.md

@@ -0,0 +1,34 @@
+<!-- DO NOT EDIT | GENERATED CONTENT -->
+
+# server dbcrypt delete
+
+Delete all encrypted data from the database. THIS IS A DESTRUCTIVE OPERATION.
+
+Aliases:
+
+- rm
+
+## Usage
+
+```console
+coder server dbcrypt delete [flags]
+```
+
+## Options
+
+### --postgres-url
+
+|             |                                                            |
+| ----------- | ---------------------------------------------------------- |
+| Type        | <code>string</code>                                        |
+| Environment | <code>$CODER_EXTERNAL_TOKEN_ENCRYPTION_POSTGRES_URL</code> |
+
+The connection URL for the Postgres database.
+
+### -y, --yes
+
+|      |                   |
+| ---- | ----------------- |
+| Type | <code>bool</code> |
+
+Bypass prompts.

docs/cli/server_dbcrypt_rotate.md

@@ -0,0 +1,48 @@
+<!-- DO NOT EDIT | GENERATED CONTENT -->
+
+# server dbcrypt rotate
+
+Rotate database encryption keys.
+
+## Usage
+
+```console
+coder server dbcrypt rotate [flags]
+```
+
+## Options
+
+### --new-key
+
+|             |                                                               |
+| ----------- | ------------------------------------------------------------- |
+| Type        | <code>string</code>                                           |
+| Environment | <code>$CODER_EXTERNAL_TOKEN_ENCRYPTION_ENCRYPT_NEW_KEY</code> |
+
+The new external token encryption key. Must be base64-encoded.
+
+### --old-keys
+
+|             |                                                                |
+| ----------- | -------------------------------------------------------------- |
+| Type        | <code>string-array</code>                                      |
+| Environment | <code>$CODER_EXTERNAL_TOKEN_ENCRYPTION_ENCRYPT_OLD_KEYS</code> |
+
+The old external token encryption keys. Must be a comma-separated list of base64-encoded keys.
+
+### --postgres-url
+
+|             |                                       |
+| ----------- | ------------------------------------- |
+| Type        | <code>string</code>                   |
+| Environment | <code>$CODER_PG_CONNECTION_URL</code> |
+
+The connection URL for the Postgres database.
+
+### -y, --yes
+
+|      |                   |
+| ---- | ----------------- |
+| Type | <code>bool</code> |
+
+Bypass prompts.