Struct RotateKeyArgs 

pub struct RotateKeyArgs {
    pub key: RotateKeyTarget,
    pub bind_existing: bool,
    pub new_keystore: Option<PathBuf>,
    pub mbps: Option<u64>,
    pub region: Option<String>,
    pub multiaddrs: Vec<String>,
    pub accept_terms: bool,
    pub yes: bool,
    pub chain: ChainArgs,
}

decdn node rotate-key — the operator key-rotation runbook (adr/appendix-operator-key-rotation.md) as a command (#1034).

Rotation is the one operator procedure where a half-completed run is worse than no run: a node whose local key is not the on-chain-bound one is un-slashable, which is a protocol-level fault, not merely an outage. So both paths order their steps to make that state unreachable — the iroh path commits node.secret only after bindNodeId confirms, and the eth path reads chain state to pick its next phase rather than trusting a flag.

Neither path restarts the daemon. The node key is not hot-reloadable (admin_v1_reload and SIGHUP cover mutable config fields — see the node’s runtime/reload.rs for the set — not the iroh endpoint), so the runbook’s drain → stop → rotate → restart sequence stays the operator’s to drive, with decdn node drain for the first step.

Fields

key: RotateKeyTarget

Which key to rotate: iroh or eth. Required, because rotating the wrong one is not recoverable in the same afternoon.

bind_existing: bool

(--key iroh) Bind the node key ALREADY ON DISK instead of generating a fresh one.

Two jobs, both from the runbook’s § Failure modes and rollback: repair a node whose node.secret was replaced by hand (leaving it un-slashable), and roll back a rotation by re-binding a restored .bak archive. Since nothing is generated, nothing is archived — this only submits the transaction.

new_keystore: Option<PathBuf>

(--key eth) Keystore holding the NEW Ethereum key to migrate onto. Required to reach the re-onboarding phase; the earlier phases (deregister, unbond request, window wait, withdraw) all run against the current keystore and do not need it. Passing it earlier is still useful: the address is validated against the one being migrated away from on every invocation, so a same-address mistake is caught on the first run rather than after the unbonding window.

Both keystores are unlocked from the same password source (DECDN_KEYSTORE_PASSWORD, then --keystore-password-file, then a prompt), so a headless migration needs them to share a password.

mbps: Option<u64>

(--key eth) Capacity tier to re-declare on the new address. Required at the re-onboarding phase: deregisterNode clears the declared tier and it cannot be read back afterwards, so record the value the deregister phase prints and pass it here.

region: Option<String>

(--key eth) regionHint for the re-registration. Defaults to the old address’s registered region.

multiaddrs: Vec<String>

(--key eth) QUIC multiaddr for the re-registration. Repeatable. Defaults to the multiaddrs the old address registered.

accept_terms: bool

(--key eth) Accept the network’s current operator terms non-interactively. Re-registration from a new address is a fresh registration, so it re-accepts terms (ADR 019 § Terms Acceptance); --key iroh never does, because rebinding signs the terms-free BindNodeId payload.

yes: bool

Skip the interactive confirmation. Required from a non-interactive shell. The consequences are printed either way — this suppresses the prompt, not the warning.

chain: ChainArgs

Chain coordinates: RPC endpoint, contract addresses, and keystore.

Trait Implementations

impl Args for RotateKeyArgs

fn group_id() -> Option<Id>

Report the ArgGroup::id for this set of arguments

fn augment_args<'b>(__clap_app: Command) -> Command

Append to Command so it can instantiate Self via FromArgMatches::from_arg_matches_mut

fn augment_args_for_update<'b>(__clap_app: Command) -> Command

Append to Command so it can instantiate self via FromArgMatches::update_from_arg_matches_mut

impl Debug for RotateKeyArgs

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl FromArgMatches for RotateKeyArgs

fn from_arg_matches(__clap_arg_matches: &ArgMatches) -> Result<Self, Error>

Instantiate Self from ArgMatches, parsing the arguments as needed.

fn from_arg_matches_mut( __clap_arg_matches: &mut ArgMatches, ) -> Result<Self, Error>

Instantiate Self from ArgMatches, parsing the arguments as needed.

fn update_from_arg_matches( &mut self, __clap_arg_matches: &ArgMatches, ) -> Result<(), Error>

Assign values from ArgMatches to self.

fn update_from_arg_matches_mut( &mut self, __clap_arg_matches: &mut ArgMatches, ) -> Result<(), Error>

Assign values from ArgMatches to self.