docs(readme): key rotation in docker (#7721)
* docs(readme): key rotation in docker Adds notes from https://github.com/ipfs/go-ipfs/issues/7714#issuecomment-706319721
Marcin Rataj committed
Nov 10, 2020 at 21:25 UTC
2539c7617799358e858d9571754e7c30c72285a3
1 file changed
+16
README.md
+16
@@ -378,6 +378,8 @@ When starting a container running ipfs for the first time with an empty data dir
378
379
docker run -d --name ipfs_host -e IPFS_PROFILE=server -v $ipfs_staging:/export -v $ipfs_data:/data/ipfs -p 4001:4001 -p 4001:4001/udp -p 127.0.0.1:8080:8080 -p 127.0.0.1:5001:5001 ipfs/go-ipfs:latest
380
381
+#### Private swarms inside Docker
382
+
383
It is possible to initialize the container with a swarm key file (`/data/ipfs/swarm.key`) using the variables `IPFS_SWARM_KEY` and `IPFS_SWARM_KEY_FILE`. The `IPFS_SWARM_KEY` creates `swarm.key` with the contents of the variable itself, whilst `IPFS_SWARM_KEY_FILE` copies the key from a path stored in the variable. The `IPFS_SWARM_KEY_FILE` **overwrites** the key generated by `IPFS_SWARM_KEY`.
384
385
docker run -d --name ipfs_host -e IPFS_SWARM_KEY=<your swarm key> -v $ipfs_staging:/export -v $ipfs_data:/data/ipfs -p 4001:4001 -p 4001:4001/udp -p 127.0.0.1:8080:8080 -p 127.0.0.1:5001:5001 ipfs/go-ipfs:latest
@@ -387,6 +389,20 @@ The swarm key initialization can also be done using docker secrets **(requires d
389
cat your_swarm.key | docker secret create swarm_key_secret -
390
docker run -d --name ipfs_host --secret swarm_key_secret -e IPFS_SWARM_KEY_FILE=/run/secrets/swarm_key_secret -v $ipfs_staging:/export -v $ipfs_data:/data/ipfs -p 4001:4001 -p 4001:4001/udp -p 127.0.0.1:8080:8080 -p 127.0.0.1:5001:5001 ipfs/go-ipfs:latest
391
392
+#### Key rotation inside Docker
393
+
394
+If needed, it is possible to do key rotation in an ephemeral container that is temporarily executing against a volume that is mounted under `/data/ipfs`:
395
+
396
+```sh
397
+# given container named 'ipfs-test' that persists repo at /path/to/persisted/.ipfs
398
+$ docker run -d --name ipfs-test -v /path/to/persisted/.ipfs:/data/ipfs ipfs/go-ipfs:v0.7.0
399
+$ docker stop ipfs-test
400
+
401
+# key rotation works like this (old key saved under 'old-self')
402
+$ docker run --rm -it -v /path/to/persisted/.ipfs:/data/ipfs ipfs/go-ipfs:v0.7.0 key rotate -o old-self -t ed25519
403
+$ docker start ipfs-test # will start with the new key
404
+```
405
+
406
### Troubleshooting
407
408
If you have previously installed IPFS before and you are running into problems getting a newer version to work, try deleting (or backing up somewhere else) your IPFS config directory (~/.ipfs by default) and rerunning `ipfs init`. This will reinitialize the config file to its defaults and clear out the local datastore of any bad entries.