Creating a database with TDE
============================

Create a new EDB Postgres Advanced Server cluster with TDE enabled.

-  Set the environment variables to export the ``wrap`` and ``unwrap``
   commands for encryption.

-  Initialize a server with encryption enabled.

-  Start the database server.

-  Verify TDE is enabled.

Worked example
--------------

This example uses EDB Postgres Advanced Server 15 running on a Linux
platform. It uses openssl to define the passphrase to wrap and unwrap
the generated data encryption key.

1. Set the data encryption key (wrap) and decryption (unwrap)
   environment variables:

.. code:: shell

      export PGDATAKEYWRAPCMD=openssl enc -e -aes-128-cbc -pass pass:ok -out %p
      export PGDATAKEYUNWRAPCMD=openssl enc -d -aes-128-cbc -pass pass:ok -in %p

..  Note::
   - If you are on Windows you don't need the single quotes around the variable value.   - Ensure you replace `ok`  with the passphrase you want to use to wrap the data encryption key. !!!

1. Initialize the cluster using ``initdb`` with encryption enabled. This
   command sets the ``data_encryption_key_unwrap_command`` parameter in
   the postgresql.conf file.

.. code:: shell

      /usr/edb/as15/bin/initdb --data-encryption -D /var/lib/edb/as15/data 

1. Start the cluster:

.. code:: shell

      /usr/edb/as15/bin/pg_ctl -D /var/lib/edb/as15/data start

1. Run grep on postgresql.conf to verify the setting of
   ``data_encryption_key_unwrap_command`` :

.. code:: shell

      grep data_encryption_key_unwrap_command /var/lib/edb/as15/data/postgresql.conf
      __OUTPUT__
      data_encryption_key_unwrap_command = openssl enc -d -aes-128-cbc -pass pass:ok -in %p

1. :ref:`Verifying TDE is enabled <Verifying TDE is enabled>`  .