Reference: Virtru Private Keystore (for Google Workspace) - Migration Guide

Overview

This guide outlines the recommended steps for migrating an existing Virtru Private Keystore for Google Workspace to a new server. This is applicable for organizations looking to change infrastructure, upgrade operating systems, or relocate services for high availability or scaling reasons.

Pre-Migration Checklist

Before beginning the migration, ensure the following:

• Access to both the old and new servers (SSH/root access)
• Docker installed on the new server
• The new server meets the minimum system requirements:
  • 2–4 CPUs (recommended more than 4 for performance)
  • 8–16 GB RAM
  • 60–120 GB disk space
• All necessary DNS and firewall rules are in place (e.g., allow port 443 for HTTPS communication)
• Backup of the /var/virtru/cse/ directory including .env, certificates, config files, and logs
• Refer to our document on Installing an Additional Server for high-level guidance

Step 1: Prepare the New Server

Install dependencies:

sudo su
# Podman
yum install podman

# OR

sudo su
# Docker CE
sudo curl -sSL https://get.docker.com/ | sh

Create working directories:

sudo su
mkdir -p /var/virtru/cse/
mkdir -p /var/virtru/scripts
cd /var/virtru/scripts

Pull the latest container image and prepare install files:

curl -s https://api.github.com/repos/virtru/cse-install-script/releases/latest \
| grep "browser_download_url.*sh" \
| cut -d : -f 2,3 \
| tr -d \" \
| wget -qi -

#Run the deploy script 

sh deploy-cse-<version>.sh

Step 2: Backup and Transfer from the Old Server

Backup your existing directories:

cd /var/virtru
mkdir -p backup
cd backup
cp -r /var/virtru/cse .

Stop the container(s) on the old server:

docker ps
docker stop <container_id>
docker rm <container_id>

#OR

podman ps
podman stop <container_id>
podman rm <container_id>

Copy required files:

Open and copy configuration files from:

• /var/virtru/cse/.env (env variables)
• /var/virtru/cse/.crt and .key (certs and keys)
• /var/virtru/cse/run.sh 

Or transfer files using SCP:

scp -r /var/virtru/cse/* user@NEW_SERVER:/var/virtru/cse/

Step 3: Configure the New Server

After copying the files to the new server:

Review and update configuration:

• Update .env and cert values if FQDN is changing

sudo chown -R root:root /var/virtru/cse
sudo chmod -R 600 /var/virtru/cse/*.env

Edit the run.sh script if needed to reflect the correct container image version.

Step 4: Start the cse Container

cd /var/virtru/cse
sh run.sh

Step 5: DNS and Connectivity Update

• Point DNS A record to the new server’s IP
• Ensure TLS certs match the cse hostname
• Open port (443) Inbound and Outbound

Step 6: Validate cse Functionality

Check container status:

docker ps
docker logs -f <container_name>

#OR

podman ps
podman logs -f <container_name>

Check cse status endpoint:

curl https://cse.example.com/status

Or open in a browser: https://csesrv.example.com/status

Check certs:

openssl x509 -in /var/virtru/cse/ssl/cse.example.com.crt -text -noout
openssl rsa -in /var/virtru/cse/ssl/cse.example.com.key -check

Step 7: Decommission the Old Server

After validation:

• Shut down the old container(s)
• Wipe sensitive data (optional)
• Remove old DNS references

Troubleshooting Tips

• Run docker ps or podman ps to verify the container is active
• Check /var/virtru/cse/logs for startup or TLS errors
• Confirm certificates and FQDN alignment
• Ensure port 443 is open for incoming traffic

Appendix: Useful Commands