Skip to content
Alcarta

Back up data and rotate keys

Back up PostgreSQL with a method that provides point-in-time recovery. Redis holds coordination state and is not the system of record, but a Redis loss can interrupt waits and worker leases.

Back up all long-lived key files separately from the database and encrypt the backup. A database backup without the matching key-encryption keys cannot restore stored mailbox credentials. Test a restore into an isolated environment before relying on the procedure.

Inspect and rotate the KEK

Section titled “Inspect and rotate the KEK”

Generate a new key file without overwriting an existing one:

Terminal window
gw-server kek generate --out /run/secrets/kek-new

Mount both the old and new keys, promote the new version with GW_KEK_ACTIVE_ID, restart, and confirm the loaded slots:

Terminal window
gw-server kek status

Re-wrap data-encryption keys in bounded batches. A dry run is available:

Terminal window
gw-server rotate-kek --to key_… --batch 200 --sleep-ms 50 --dry-run
gw-server rotate-kek --to key_… --batch 200 --sleep-ms 50
gw-server kek verify --expect key_…

Rotation is resumable and does not re-encrypt mailbox ciphertext. Remove the old key only after kek verify succeeds on every live row and you have updated the protected backup set.

Use the same staged overlap approach for JWT signing keys: publish the new signing key, retain verification material for tokens already issued, then retire the old key after their maximum lifetime.