SECure LEDger

Summary

How to keep secrets secret. API Keys, long living tokens etc. Bad practice to keep them in txt file. This software allows to encrypt the secrets and use them in commands.

Compile this software yourself so you can be aware how it works. See compiling options below. If you don't have tools, download prebuilt releases from GitHub: secled Releases

Keep it on an USB stick (recommended) or in your home directory (still better than txt file (in the Git repo :D))

Use it on your prompt

Create and use secret on the fly!

kubectl create secret generic jwtkey --from-literal=JWTKEY="`secled generate-64hex my_sandbox_jwtkey -o`" --namespace=q-sandbox

secret/jwtkey created

Check (better do not print it out, but for demo)

secled get my_sandbox_jwtkey

88638c304f3a1d049dfd68f8bdda4634ae5d4c08f44dfc04c416437383955379

Using secled for creating Kubernetes secrets

secret="$(secled get ghcr-password)"
kubectl -n myapp-sandbox create secret docker-registry ghcr-secret
--docker-server=ghcr.io
--docker-username=exampleusername
--docker-password="$secret"
--docker-email=example@example.com unset secret

Testing some webhook

TOKEN="$(secled get webhook-token)" PAYLOAD='{ "instruction": "rollout" }' SIG=$(echo -n "$PAYLOAD" | openssl dgst -sha256 -hmac "$TOKEN" | sed 's/^.* //') curl -X POST http://localhost:8080/deploy/mayapp-sandbox/myapp -H "X-Hub-Signature-256: sha256=$SIG" -d "$PAYLOAD"

How to use it

Linux/macOS (bash/zsh)

Build:

go build -o bin/secled ./cmd

Add aliases to your ~/.bashrc or ~/.zshrc:

alias secled="~/MYGITHUBDIRS/secled/bin/secled"
alias secled-login='eval "$(secled login)"'
alias secled-logout='eval "$(secled logout)"'

Login:

secled-login

List keys (works without password):

secled list

Add a key:

secled add ghcr-password

Update a key:

secled update ghcr-password

Get a key:

secled get ghcr-password

Generate a UUID v4 and store it:

secled generate-uuid deploy-id

Generate a 64-char hex secret and store it:

secled generate-64hex jwt-secret

Generate and output the value while storing it:

secled generate-uuid -o deploy-id
secled generate-64hex -o jwt-secret

Remove a key:

secled remove ghcr-password

Logout:

secled-logout

Windows (PowerShell)

Build:

go build -o bin\secled.exe .\cmd

Add aliases to your PowerShell profile (create it if missing). Update the path to wherever you cloned secled:

notepad $PROFILE

Add these lines:

function secled { & "C:\Users\<user\githubfolders>\secled\bin\secled.exe" @Args }
function secled-login { & secled login | Invoke-Expression }
function secled-logout { & secled logout | Invoke-Expression }

Reload your profile:

. $PROFILE

Login:

secled-login

List keys:

secled list

Add a key:

secled add ghcr-password

Update a key:

secled update ghcr-password

Get a key:

secled get ghcr-password

Generate a UUID v4 and store it:

secled generate-uuid deploy-id

Generate a 64-char hex secret and store it:

secled generate-64hex jwt-secret

Generate and output the value while storing it:

secled generate-uuid -o deploy-id
secled generate-64hex -o jwt-secret

Remove a key:

secled remove ghcr-password

Logout:

secled-logout

Copy to your USB stick

Copy the bin directory to your USB drive. The ledger file is stored next to the binary, so keep them together.