These options enable and configure transparent data encryption when you initialize a cluster with initdb.
Option: --data-encryption or -y
Adds transparent data encryption when initializing a database server.
Supported values
You can optionally specify an AES key length in the form of --data-encryption[=KEYLEN].
Valid values are 128 and 256. The default is 128.
AES-256 is available starting with TDE 16.
Option: --key-wrap-command=<command>
Provides the wrapping/encryption command to protect the data encryption key.
Supported values
<command> is customizable, but it must contain the placeholder %p, which TDE replaces with the path to the key file. TDE runs the command from the data directory, so this path can be relative to it. The command receives the plaintext key on standard input and must write the wrapped key to the file path given by %p.
Note
The wrap and unwrap commands are assumed to run with the current working directory set to the data directory of the Postgres server. Changing the working directory at run time can lead to unexpected results.
If you don't use this option, TDE falls back on the environment variable PGDATAKEYWRAPCMD. See Choosing a key protection mechanism for an overview of available wrapping mechanisms, and each mechanism's page for worked examples using environment variables or command-line arguments.
Use the special value - if you don't want to apply a wrapping mechanism.
Option: --key-unwrap-command=<command>
Provides the unwrapping/decryption command to access the data encryption key.
Supported values
<command> is customizable, but it must contain the placeholder %p, which TDE replaces with the path to the key file. The command must read the wrapped key from the file path given by %p and write the decrypted key to standard output.
If you don't use this option, TDE falls back on the environment variable PGDATAKEYUNWRAPCMD.
Use the special value - if you didn't apply a wrapping mechanism.
Option: --no-key-wrap
Disables the key wrapping. The data encryption key is instead stored in plaintext in the data directory. (This option is a shortcut for setting both the wrap and the unwrap command to the special value -.)
Note
Using this option isn't secure. Only use it for testing purposes.
If you select data encryption and don't specify this option, then you must provide a key wrap and unwrap command. Otherwise, initdb terminates with an error.
Supported values
The --no-key-wrap option doesn't require specifying any values.
Option: --copy-key-from=<file>
Copies an existing data encryption key from the provided location, for example, when reusing a key from an existing server during an upgrade with pg_upgrade.
Supported values
<file> is the directory to the existing key. Normally, encryption keys are stored in pg_encryption/key.bin.