# coder server dbcrypt rotate

Rotate database encryption keys.

## Usage [#usage]

```console
coder server dbcrypt rotate [flags]
```

## Options [#options]

### --postgres-url [#--postgres-url]

|             |                                          |
| ----------- | ---------------------------------------- |
| Type        | <code>string</code>                      |
| Environment | <code>$CODER\_PG\_CONNECTION\_URL</code> |

The connection URL for the Postgres database.

### --postgres-connection-auth [#--postgres-connection-auth]

|             |                                           |
| ----------- | ----------------------------------------- |
| Type        | <code>password\|awsiamrds</code>          |
| Environment | <code>$CODER\_PG\_CONNECTION\_AUTH</code> |
| Default     | <code>password</code>                     |

Type of auth to use when connecting to postgres.

### --new-key [#--new-key]

|             |                                                                     |
| ----------- | ------------------------------------------------------------------- |
| Type        | <code>string</code>                                                 |
| Environment | <code>$CODER\_EXTERNAL\_TOKEN\_ENCRYPTION\_ENCRYPT\_NEW\_KEY</code> |

The new external token encryption key. Must be base64-encoded.

### --old-keys [#--old-keys]

|             |                                                                      |
| ----------- | -------------------------------------------------------------------- |
| Type        | <code>string-array</code>                                            |
| Environment | <code>$CODER\_EXTERNAL\_TOKEN\_ENCRYPTION\_ENCRYPT\_OLD\_KEYS</code> |

The old external token encryption keys. Must be a comma-separated list of base64-encoded keys.

### -y, --yes [#-y---yes]

|      |                   |
| ---- | ----------------- |
| Type | <code>bool</code> |

Bypass confirmation prompts.