# winch secret generate

make a random password as a secret

## Examples

```sh
# write a password as the default of a variable in winch.yaml
winch secret generate vars.monit_password
```

```sh
# write a password into the vars of one host
winch secret generate hosts.db1.acme.com.vars.db_password
```

```sh
# write a password into the inventory production
winch secret generate inventories.production.groups.all.vars.db_password
```

```sh
# print a password as a !secret value
winch secret generate
```

## Usage

```
winch secret generate [<path>]
```

Generate makes a random password of 32 letters and digits and encrypts it for the recipients in winch.yaml. With a path, it writes the !secret value at the path; without one, it prints it. It never prints the password.

A path names a place in the project, with keys joined by ".". vars.x is the default of x in winch.yaml, and recipes.mail.vars.mail\_x a default in the recipe mail. groups.all.vars.x and hosts.web1.vars.x are in the inventory at the top of winch.yaml, and inventories.prod.groups.all.vars.x is in the inventory prod. A path can go on into a map variable, such as vars.users.alice, but not into a list. A key with dots or "\[" stands in brackets and double quotes, such as vars.dkim\_keys\["acme.com"\].

The command replaces the value at the path, or adds a missing path with the maps it needs. The inventory, the recipe, the host, and the group must exist; the group all always exists. Something in the project must read the variable, and a variable has one default. The file keeps its comments and layout.

## See

- `winch doc secrets`