knot-keystore 0.1.0a1

A tool for safely archiving knot dnssec key material to azure.

knot-keystore

A tool to safely backup the knot kasp-db directory.

overview

usage: knot-keystore [-h] [--socket SOCKET] [--plugin {local,azure}]
                     [--config-file CONFIG_FILE] [-v]

optional arguments:
  -h, --help            show this help message and exit
  --socket SOCKET, -s SOCKET
                        path to knotc control socket
  --plugin {local,azure}, -p {local,azure}
                        select archival plugin
  --config-file CONFIG_FILE, -c CONFIG_FILE
                        path to a configuration file
  -v                    increase output verbosity

• tries to find the kasp-db path by reading knotd config over the control socket.
• plugins create an xz-compressed archive and put it somewhere safe.

plugins

• local: create an encrypted copy of the archive and write it to disk along with the encryption key. Mostly useful for testing.
• azure: write the archive to an Azure storage blob, first encrypting it using "client-side-encryption" with a KEK stored in Azure Key Vault.