import { TabsGroup, TabsItem } from "@/components/DocsTabs";
import Alert from "@/components/DocsAlert";

# Regenerate Secret Keys

When you install Firezone, secrets are generated for encrypting database fields,
securing WireGuard tunnels, securing cookie sessions, and more.

If you're looking to regenerate one or more of these secrets, it's possible to
do so using the same bootstrap scripts that were used when installing Firezone.

## Regenerate secrets

<Alert
  color="danger"
  html={`
Replacing the <code>DATABASE_ENCRYPTION_KEY</code> will render all encrypted data in the
database useless. This <strong>will</strong> break your Firezone install unless you are
starting with an empty database. You have been warned.
`}
/>

<Alert
  color="warning"
  html={`
Replacing <code>GUARDIAN_SECRET_KEY</code>, <code>SECRET_KEY_BASE</code>,
<code>LIVE_VIEW_SIGNING_SALT</code>,
<code>COOKIE_SIGNING_SALT</code>, and <code>COOKIE_ENCRYPTION_SALT</code>
will reset all browser sessions and REST API tokens.
`}
/>

Use the procedure below to regenerate secrets:

<TabsGroup>
<TabsItem title="Docker" active>

Navigate to the Firezone installation directory, then:

```bash
mv .env .env.bak
docker run firezone/firezone bin/gen-env > .env
```

Now, move desired env vars from `.env.bak` back to `.env`, keeping the new
secrets intact.

</TabsItem>
<TabsItem title="Omnibus">

```bash
mv /etc/firezone/secrets.json /etc/firezone/secrets.bak.json
sudo firezone-ctl reconfigure
```

</TabsItem>
</TabsGroup>

## Regenerate WireGuard private key

<Alert
  color="warning"
  html={`
  Replacing the WireGuard private key will render all existing device configs
  invalid. Only do so if you're prepared to also regenerate device configs after
  regenerating the WireGuard private key.
`}
/>

To regenerate WireGuard private key, simply move or rename the private key file.
Firezone will generate a new one on next start.

<TabsGroup>
<TabsItem title="Docker" active>

```bash
cd $HOME/.firezone
docker-compose stop firezone
sudo mv firezone/private_key firezone/private_key.bak
docker-compose start firezone
```

</TabsItem>
<TabsItem title="Omnibus">

```bash
sudo firezone-ctl stop phoenix
sudo mv /var/opt/firezone/cache/wg_private_key /var/opt/firezone/cache/wg_private_key.bak
sudo firezone-ctl start phoenix
```

</TabsItem>
</TabsGroup>
