winch secret init

add an age key to the recipients

Examples

# make a key when there is none, and add it to the recipients
winch secret init

# use the key at another path
WINCH_AGE_KEY=~/keys/acme.key winch secret init

winch secret init

Init makes an age key when there is none, prints its public key, and adds the public key to recipients in winch.yaml when it is not in the list.

The key is the file that WINCH_AGE_KEY names, or else ~/.config/winch/age.key. A new key gets mode 0600, and its directory 0700.

With WINCH_AGE_IDENTITY_CMD, init makes no key and reads the public key from the stdout of the command. Both variables set is an error.

The new key can read the secrets only after a member who can read them runs winch secret rekey.