winch secret

manage secrets and the age key

Examples

# make your age key and add it to the recipients
winch secret init

# write a random password as the default of a variable
winch secret generate vars.monit_password

# write the content of a file as the default of a variable
winch secret encrypt vars.dkim_key < dkim.key

# print the output of a command as a !secret value
openssl rand -hex 16 | winch secret encrypt

# print the plaintext of a secret
winch secret decrypt vars.monit_password

# encrypt all secrets again after a change of the recipients
winch secret rekey

Usage

winch secret <command>

Secret encrypts values with age for the recipients in winch.yaml.

winch reads the age key from the stdout of the command in WINCH_AGE_IDENTITY_CMD, which runs through sh -c. Without it, winch reads the file that WINCH_AGE_KEY names, or else ~/.config/winch/age.key. Both variables set is an error.

See

winch doc secrets