DOCSEARCHbyAlgolia
Submit Docs

scrt

website·Indexed 32 days ago

https://scrt.run

A secret manager for the command line that allows users to encrypt and decrypt secrets without requiring a background process or daemon. It supports multiple storage types, including local filesystem, Git repositories, and AWS S3 or compatible object storage.

Tokens
3.9K
Snippets
33
Records
45
Agent score
58%

What's inside scrt

  1. Overview of scrt secret management

    scrt is a command-line tool for secure secret management that requires no background service or daemon installation. It performs all encryption and decryption locally on the client machine using AES-256 encryption and Argon2id key derivation, ensuring that passwords, keys, and plaintext data are never transmitted over the internet. It supports multiple storage backends, including the local filesystem, AWS S3 (or S3-compatible storage), and git repositories.

  2. Overview of scrt secret management

    scrt is a command-line secret manager designed for developers, sysadmins, and DevOps. It allows users to encrypt and decrypt secrets using a 'store'—a single encrypted file that can be kept locally or hosted remotely (e.g., AWS S3 or a Git repository).

    Technical specifications:

    • Encryption: Uses AES-256 symmetric encryption.
    • Key Derivation: Uses Argon2id to derive 256-bit keys from a user-provided password.
    • Key Rotation: A new key is derived from the password every time the store is re-encrypted to prevent key re-use.
    • Data Format: Each secret is referenced by a name and can be an arbitrary string of bytes of any length.

  3. Use the scrt command-line secret manager

    The scrt tool is a secret manager for the command-line. It allows users to initialize stores, manage key-value pairs, and configure storage types. Use scrt --help to output the full help message.
    scrt [command]

  4. Use Git as a storage backend for scrt

    The git storage type allows scrt to create and access a store within a git repository. When configured, scrt clones the repository in memory, checks out the specified branch, and reads the store from the designated file path. Any modifications made to the store are automatically committed and pushed back to the remote repository. If no existing repository can be cloned, scrt will initialize a new one.

  5. Manage scrt configuration precedence

    The scrt CLI determines configuration settings based on a specific order of precedence. Settings defined in a more explicit method override those in less explicit methods. The order from highest to lowest precedence is:

    1. Command-line flags
    2. Environment variables
    3. Configuration file

  6. Understand scrt's security and privacy model

    scrt implements a zero-trust security model: it does not store encryption keys in the store and never transfers plaintext data over the network. All encryption and decryption processes occur locally on the user's machine during runtime. Because of this architecture, the entire store must be loaded into memory and decrypted every time the program is run. For very large stores, users are advised to either split the data into multiple stores or download the store to the local filesystem before execution.

  7. Initialize a new scrt store with local storage

    Initialize a new encrypted store using the scrt init command. When using local storage, the store is created as a file encrypted with a key derived from the provided password. Note: If the password is lost, the secrets cannot be recovered.
    scrt init --storage=local \ 
          --password=p4ssw0rd \ 
          --local-path=store.scrt

  8. Install scrt on RHEL, CentOS, or Rocky Linux using yum

    Create a repository configuration file at /etc/yum.repos.d/scrt.repo with the specified repository details, then install the scrt package.
    # /etc/yum.repos.d/scrt.repo
[scrt]
name=scrt
baseurl=https://yum.scrt.run
repo_gpgcheck=1
gpgcheck=1
enabled=1
gpgkey=https://yum.scrt.run/key.gpg
sslverify=1
metadata_expire=300
    sudo yum update
sudo yum install scrt

  9. Install scrt using go get

    Use the Go toolchain to download and build the latest version of scrt. The resulting binary will be located in the binaries directory of your GOPATH.
    go get github.com/loderunner/scrt

  10. Manage secrets using the scrt CLI

    Use the scrt command-line interface to manage secrets using a key-value pattern. You must provide a store password via the SCRT_PASSWORD environment variable to authenticate operations. Use set to add a secret, get to retrieve one, and unset to remove one.
    # Set store password in environment
export SCRT_PASSWORD=*******

# Add a secret to the store
scrt set greeting 'Good news, everyone!'

# Retrieve the secret from the store
scrt get greeting
# Output: Good news, everyone!

  11. Install scrt via binary release

    Download the latest binary release for your platform from the GitHub releases page, decompress the archive, and move the binary to a directory in your system PATH (e.g., /usr/local/bin).
    tar xzvf scrt_0.3.3_linux_x86_64.tar.gz
sudo cp scrt_0.3.3_linux_x86_64/scrt /usr/local/bin/scrt