> For the complete documentation index, see [llms.txt](https://documentation.grax.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://documentation.grax.com/technology/operate/rotating-infrastructure-secrets.md).

# Rotating Infrastructure Secrets

The GRAX Application reads its secrets from the environment (normally `.env`): a Postgres connection string, an administrator password, and `SECRET_STORE_BASE`, the key base that encrypts the DB-based Secrets Store holding SFDC and storage connection secrets. Rotation is mostly external to the GRAX Application, with one exception.

{% hint style="warning" %}
This guide assumes you're comfortable with the concepts from [Install on Linux](/technology/deploy/install-on-linux.md), and its examples assume an environment that matches that guide. If your environment differs, some commands may not work as written.
{% endhint %}

## Rotating Database Connection String or Administrator Password

To rotate the connection string used to connect to the Postgres database cluster manually, perform the following steps:

1. Stop the GRAX services

   ```bash
   $ systemctl disable grax.service; systemctl stop grax.service;
   ```
2. Update the configuration source/file with your editor of choice:

   ```bash
   $ vim .env

   [change intended key\'s value to new value and save file]
   ```
3. Start the GRAX services

   ```bash
   $ systemctl enable grax.service; systemctl start grax.service;
   ```

If you have interest in automating this behavior, the automation needs to preserve or recreate the other necessary values for the configuration.

## Rotating SECRET\_STORE\_BASE

The SECRET\_STORE\_BASE is used to encrypt the SFDC and Storage secrets in the database. Changing this value between reboots without proper care results in these secrets being irrecoverable and the GRAX Application being unable to start properly; a manual reset of configuration information in the database is the only recovery option. If this issue occurs, please contact [GRAX Support](https://documentation.grax.com/support/get-support) for assistance clearing the configuration.

To properly rotate this value, perform the following steps:

1. Stop the GRAX services

   ```bash
   $ systemctl disable grax.service; systemctl stop grax.service;
   ```
2. Update the `SECRET_STORE_BASE` to the new value with your editor of choice
3. Update the `SECRET_STORE_BASE_PREV` to the previous value with your editor of choice
4. Start the GRAX services

   ```bash
   $ systemctl enable grax.service; systemctl start grax.service;
   ```

At this point, the GRAX Application reads the configuration secrets with the old key and writes them with the new key on first boot. It is not necessary to remove the `SECRET_STORE_BASE_PREV` value from the configuration file. If you desire the removal of the old value, you can do so after the GRAX Application has been started successfully for two minutes; stop the services, update the `.env`, and start the services again.