scrt Secret Manager

scrt is a command-line secret manager designed for developers, sysadmins, and DevOps engineers. It provides a secure way to encrypt and decrypt secrets directly from the CLI, allowing users to maintain full control over their storage backends. You can choose between various secure storage backends, including local storage or remote network-based storage, avoiding the need for GUI-centered tools or expensive cloud services.

Warning: This project is currently under development and not production ready. Use at your own risk.

scrt is a command-line secret manager designed for developers, sysadmins, and DevOps engineers. It allows you to encrypt and decrypt secrets using a variety of secure storage backends, which can be located locally on your machine or remotely over a network.

It is intended as a lightweight, reliable alternative to expensive cloud-based services, complex self-hosted solutions (like HashiCorp Vault), or GUI-centric password managers.

scrt is a command-line secret manager designed for developers, sysadmins, and devops. It allows you to encrypt and decrypt secrets using a key-value interface without requiring a background daemon or service. All cryptography (AES-256 encryption and Argon2id key derivation) is performed locally on your machine, ensuring that plaintext data and passwords never travel over the internet.

Key features include:

• No Background Process: Operates as a single command on Linux, Windows, and macOS.
• Local Encryption: All cryptographic operations happen on your client.
• Configurable Storage: Supports multiple backends including the local filesystem, AWS S3 (or S3-compatible storage), and git repositories.
• Flexible Configuration: Options can be set via command-line arguments, configuration files, or environment variables.

The git storage type allows you to manage secrets within a Git repository. When using this backend, scrt performs the following lifecycle:

1. Clones the repository into memory.
2. Checks out the specified branch (or the default branch).
3. Reads the secret store from the file specified by --git-path.
4. Automatically commits and pushes any modifications (via init, set, or unset) back to the remote repository.

Note: scrt will initialize a new repository if it cannot find an existing one at the provided URL.

scrt init --storage=git \
          --password=p4ssw0rd \
          --git-url=git@github.com:githubuser/secrets.git \
          --git-path=store.scrt

scrt follows a zero-trust security model.

• No Key Storage: scrt does not save keys in the store.
• Local Processing: All encryption and decryption operations occur locally on your machine while the program is running. Plaintext is never transferred over the network.
• Memory Usage: Because all operations happen locally, the entire store must be loaded into memory (and potentially downloaded via the network) for every command.

Performance Tip: If your store becomes very large and causes performance issues, you can:

1. Split your secrets into multiple separate stores.
2. Download the entire store to your local filesystem before running commands.

When configuring scrt, settings are applied based on an order of precedence. If a setting is defined in multiple places, the more 'explicit' source wins. The order from highest to lowest precedence is:

1. Command-line flags (Highest precedence)
2. Environment variables
3. Configuration file (Lowest precedence)

scrt uses industry-standard symmetric encryption to secure your secrets.

• Algorithm: AES-256-GCM (Advanced Encryption Standard with 256-bit keys in Galois/Counter Mode).
• Key Derivation: Encryption keys are derived from your password using the Argon2id key derivation function.
• Salting: A new random salt is generated every time the store is written, which prevents cryptographic key reuse.

You can perform basic CRUD operations on your secrets using the following commands:

• Set/Create/Update: Use scrt set <key> <value> to store a secret. If the key already exists, the value will be updated.
• Retrieve: Use scrt get <key> to print the value of a secret to stdout.
• Delete: Use scrt unset <key> to remove a secret from the store.

If you attempt to get a key that does not exist, scrt will return an error.

# Set a secret
scrt set hello 'World!'

# Retrieve a secret
scrt get hello

# Update an existing secret
scrt set hello 'Brooklyn'

# Delete a secret
scrt unset hello

Configure the yum repository by creating a file at /etc/yum.repos.d/scrt.repo with the following configuration, then install using yum.

# Create /etc/yum.repos.d/scrt.repo with this content:
[scrt]
name=scrt
baseurl=https://yum.scrt.run
repo_gpgcheck=1
gpgcheck=1
enabled=1
gpgkey=https://yum.scrt.run/key.gpg
sslverify=1
metadata_expire=300

sudo yum update
sudo yum install scrt

scrt is particularly useful for engineering teams needing straightforward secret sharing. Common use cases include:

• CI/CD Integration: Storing secrets in a file at the root of a project repository to be retrieved during continuous integration.
• Team Collaboration: Using a git repository to share secrets easily among team members without introducing complex new tools.
• Infrastructure as Code (IaC): Retrieving a store from S3 to use secrets within Ansible or Chef scripts during deployment.
• Cost/Complexity Reduction: Replacing expensive SaaS-based secret management solutions with a simpler, CLI-driven tool.