Zach 170c33a475 feat: encrypt gitsshkeys.private_key at rest via dbcrypt (#25872) ...

Adds an optional dbcrypt wrapper around gitsshkeys.private_key. The
column is encrypted on insert and update through enterprise/dbcrypt when
external token encryption is configured, and decrypted on read.

A new private_key_key_id column references
dbcrypt_keys(active_key_digest) so revocation safety is enforced by the
existing foreign key. Rows with a NULL key_id stay plaintext and remain
readable. Existing plaintext rows can be backfilled by running `coder
server dbcrypt rotate`.

Generated with assistance from Coder Agents.

2026-06-02 08:36:01 -06:00

..

audit-logs.md

feat: encrypt gitsshkeys.private_key at rest via dbcrypt (#25872)

2026-06-02 08:36:01 -06:00

database-encryption.md

feat: encrypt gitsshkeys.private_key at rest via dbcrypt (#25872)

2026-06-02 08:36:01 -06:00

index.md

docs(docs/admin/security): point security advisories to GitHub Security Advisories (#25813)

2026-05-29 10:23:00 +02:00

secrets.md

docs: mark user secrets as beta (#25704)

2026-05-26 15:22:17 -06:00