# winch secret

manage secrets and the age key

## Examples

```sh
# make your age key and add it to the recipients
winch secret init
```

```sh
# write a random password as the default of a variable
winch secret generate vars.monit_password
```

```sh
# write the content of a file as the default of a variable
winch secret encrypt vars.dkim_key < dkim.key
```

```sh
# print the output of a command as a !secret value
openssl rand -hex 16 | winch secret encrypt
```

```sh
# print the plaintext of a secret
winch secret decrypt vars.monit_password
```

```sh
# encrypt all secrets again after a change of the recipients
winch secret rekey
```

## Usage

```
winch secret <command>
```

Secret encrypts values with age for the recipients in winch.yaml.

winch reads the age key from the stdout of the command in WINCH\_AGE\_IDENTITY\_CMD, which runs through sh -c. Without it, winch reads the file that WINCH\_AGE\_KEY names, or else \~/.config/winch/age.key. Both variables set is an error.

## See

- `winch doc secrets`