secrets_cli

KO | EN

gitlite — search

#python #ai #llm #android #machine-learning #rust #deep-learning #linux #java #windows #awesome-list #security #pytorch #ios

(★ 25)

CLI for storing and reading your secrets via vault

secrets_cli Latest Version Download

Download Latest Version (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

[![Gem Version](https://badge.fury.io/rb/secrets_cli.svg)](https://badge.fury.io/rb/secrets_cli)

# SecretsCli

This is a CLI for easier use of [vault](https://www.vaultproject.io/)

There is also a mina plugin [mina-secrets](https://github.com/infinum/mina-secrets)

## Table of contents

1. [Installation](#installation)
1. [Prerequisites](#prerequisites)
1. [Usage](#usage)
   1. [Init](#init)
   1. [Policies](#policies)
   1. [Environments](#environments)
   1. [storage_keys and environments](#storage_keys-and-environments)
   1. [Read](#read)
   1. [Edit](#edit)
   1. [Pull](#pull)
   1. [Push](#push)
1. [Development](#development)
1. [Contributing](#contributing)
1. [License](#license)

## Installation

Add this line to your application's Gemfile:

```ruby
gem 'secrets_cli'
```

And then execute:

$ bundle

Or install it yourself as:

$ gem install secrets_cli

## Prerequisites

The following environment variables need to be set:

For `vault` itself:

VAULT_ADDR   - address to your vault server (can also be set through config)
    VAULT_CACERT - if you have a self issued certificate, point this environment variable to the location of the root CA file

For `secrets_cli`:

VAULT_AUTH_METHOD - this is auth method ('github', 'token', 'app_id' and 'approle' supported for now)
    VAULT_AUTH_TOKEN - this is vault auth token
    VAULT_AUTH_APP_ID - machine app_id (for app_id auth)
    VAULT_AUTH_USER_ID - machine user_id which matches app_id (for app_id auth)
    VAULT_AUTH_ROLE_id - machine role_id (for approle auth)
    VAULT_AUTH_SECRET_ID - machine secret_id which matches role_id (for approle auth)

For github token you only need `read:org` permissions.

## Usage

All commands have `--help` with detailed descriptions of options.
Some of the commands have `--verbose` switch which will print out the commands it run.

### Init

$ secrets init

This will create `.secrets` file with project configuration. The command will ask you all it needs to know if you do not
supply the config through options.

Example of the `.secrets`:

---
    :secrets_file: config/application.yml   # Required; file where your secrets are kept, depending on your environment gem (figaro, dotenv, etc)
    :secrets_storage_key: rails/my_project/ # Required; vault 'storage_key' where your secrets will be kept.
    development:                            # Any configuration can be nested under environment
      :vault_addr: https://myvault.com      # Optional; vault url (default: VAULT_ADDR environment variable)

### Policies

$ secrets policies

To get all the policies your auth grants please use this command.

### Environments

$ secrets list

To get the list of all current environments please use this command.

### storage_keys and environments

Next 3 commands read and write to your project storage_key in vault. The value of the storage_key is generated by
secrets_storage_key + environment. Example:

`rails/my_project/development`

Environment is `development` by default, but it can be overwriten by passing `--environment` option, or setting `RAILS_ENV` environment variable.

### Read

$ secrets read

This will read development secrets from the vault.

To read secrets from a different environment, use the `-e` flag:

$ secrets read -e production

### Edit

$ secrets edit

This will allow you to edit secrets on the fly. You choose which editor to use by defining an `$EDITOR` variable, otherwise it will use one of these: `mate -w`, `vim`, `vi`, `emacs`, `nano`, `pico`

The same flags apply for editing as for reading:

$ EDITOR='atom -w' secrets edit -e production

### Pull

$ secrets pull

This will pull from vault and write to your secrets file. The deafult file it will pull is the development one.

To pull from a different environment, also supply the `-e` flag and the `-f` flag for the file path:

$ secrets pull -e production -f config/application.production.yml

You can also supply the `--ci_mode` or `-y` flag to disable prompts and outputs.

### Push

$ secrets push

This will push from your secrets file to vault.

The same flags apply for pushing as for pulling:

$ secrets push -e production -f config/application.production.yml

## Development

After checking out the storage_key, run `bin/setup` to install dependencies. Then, run `rake spec` to run the tests. You can also run `bin/console` for an interactive prompt that will allow you to experiment.

To install this gem onto your local machine, run `bundle exec rake install`. To release a new version, update the version number in `version.rb`, and then run `bundle exec rake release`, which will create a git tag for the version, push git commits and tags, and push the `.gem` file to [rubygems.org](https://rubygems.org).

## Contributing

Bug reports and pull requests are welcome on GitHub at https://github.com/infinum/secrets_cli. This project is intended to be a safe, welcoming space for collaboration, and contributors are expected to adhere to the [Contributor Covenant](contributor-covenant.org) code of conduct.

## License

The gem is available as open source under the terms of the [MIT License](http://opensource.org/licenses/MIT).

secrets_cli

secrets_cli Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

secrets_cli

secrets_cli Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

Download README