Rotate the encryption key at runtime without downtime. The new key becomes the current key for all future writes. The old current key becomes the previous key for dual-key reads. Returns an error if the WAL has already written records to the active segment — in that case, roll to a new segment first.
(&self, new_key_path: &Path)
| 64 | /// Returns an error if the WAL has already written records to the active |
| 65 | /// segment — in that case, roll to a new segment first. |
| 66 | pub fn rotate_key(&self, new_key_path: &Path) -> crate::Result<()> { |
| 67 | let new_key = nodedb_wal::crypto::WalEncryptionKey::from_file(new_key_path) |
| 68 | .map_err(crate::Error::Wal)?; |
| 69 | |
| 70 | let mut wal = self.wal.lock().unwrap_or_else(|p| p.into_inner()); |
| 71 | let new_ring = if let Some(ring) = wal.encryption_ring() { |
| 72 | nodedb_wal::crypto::KeyRing::with_previous(new_key, ring.current().clone()) |
| 73 | } else { |
| 74 | nodedb_wal::crypto::KeyRing::new(new_key) |
| 75 | }; |
| 76 | |
| 77 | wal.set_encryption_ring(new_ring) |
| 78 | .map_err(crate::Error::Wal)?; |
| 79 | info!(new_key = %new_key_path.display(), "WAL encryption key rotated"); |
| 80 | Ok(()) |
| 81 | } |
| 82 | |
| 83 | /// Get the current encryption key (if configured). Used for backup encryption. |
| 84 | pub fn encryption_key(&self) -> Option<&nodedb_wal::crypto::WalEncryptionKey> { |
nothing calls this directly
no test coverage detected