winch secret decrypt

print the plaintext of a secret

Examples

# print the plaintext of the default of a variable
winch secret decrypt vars.monit_password

# print the plaintext of a secret in the vars of one host
winch secret decrypt hosts.db1.acme.com.vars.db_password

# print the plaintext of a !secret value
echo '!secret YWdl...' | winch secret decrypt

Usage

winch secret decrypt [<path>]

Decrypt prints the plaintext of the !secret at the path, or of a !secret value on stdin, with or without the tag. It prints nothing else, also no newline after the plaintext. It is the only command whose output holds a secret.

A path names a place in the project, with keys joined by ".". vars.x is the default of x in winch.yaml, and recipes.mail.vars.mail_x a default in the recipe mail. groups.all.vars.x and hosts.web1.vars.x are in the inventory at the top of winch.yaml, and inventories.prod.groups.all.vars.x is in the inventory prod. A path can go on into a map variable, such as vars.users.alice, but not into a list. A key with dots or "[" stands in brackets and double quotes, such as vars.dkim_keys["acme.com"].

A path to a map or to a value that is not a !secret is an error.

winch reads the age key from the stdout of the command in WINCH_AGE_IDENTITY_CMD, which runs through sh -c. Without it, winch reads the file that WINCH_AGE_KEY names, or else ~/.config/winch/age.key. Both variables set is an error.

See

• winch doc secrets