# winch secret encrypt

encrypt a value from stdin or a prompt as a secret

## Examples

```sh
# type a password and write it as the default of a variable
winch secret encrypt vars.db_password
```

```sh
# write the content of a file as the default of a variable
winch secret encrypt vars.dkim_key < dkim.key
```

```sh
# write a key into a map variable keyed by domain
winch secret encrypt 'vars.dkim_keys["acme.com"]' < acme.com.key
```

```sh
# print the output of a command as a !secret value
openssl rand -hex 16 | winch secret encrypt
```

## Usage

```
winch secret encrypt [<path>]
```

Encrypt reads a value from stdin and encrypts it for the recipients in winch.yaml. With a path, it writes the !secret value at the path; without one, it prints it.

When stdin is a terminal, encrypt asks for one line twice and does not show what you type. When the two values differ, it writes nothing.

A value of one line loses its trailing newline. A value of more lines stays as it is.

A path names a place in the project, with keys joined by ".". vars.x is the default of x in winch.yaml, and recipes.mail.vars.mail\_x a default in the recipe mail. groups.all.vars.x and hosts.web1.vars.x are in the inventory at the top of winch.yaml, and inventories.prod.groups.all.vars.x is in the inventory prod. A path can go on into a map variable, such as vars.users.alice, but not into a list. A key with dots or "\[" stands in brackets and double quotes, such as vars.dkim\_keys\["acme.com"\].

The command replaces the value at the path, or adds a missing path with the maps it needs. The inventory, the recipe, the host, and the group must exist; the group all always exists. Something in the project must read the variable, and a variable has one default. The file keeps its comments and layout.

## See

- `winch doc secrets`