Skip to content
Holden

Rotating age.key

When: Encrypted secrets may have been exposed.

Impact: All encrypted secrets become undecryptable. You’ll need to re-enter them.

Steps

Section titled “Steps”

  1. Stop Holden:

    Terminal window
    docker stop holden

  2. Delete the old key:

    Terminal window
    rm /data/age.key

  3. Restart Holden (generates new keypair):

    Terminal window
    docker start holden

  4. Re-encrypt each secret (from the app’s directory):

    Terminal window
    holden vars set --secret API_KEY "new-value"

  5. Commit updated holden.vars.yml files to your repos.