diff --git a/backup.py b/backup.py
index bc694a5..b93fe8f 100644
--- a/backup.py
+++ b/backup.py
@@ -86,26 +86,23 @@ def __add__(self, b):
         cls = type(self)
         return cls(list.__add__(self, b))
 
-class BackupConf:
-    profile = "/usr/share/tklbam/profile"
+from utils import AttrDict
 
+class BackupConf:
     path = "/etc/tklbam"
     class Paths(Paths):
-        files = [ 'address', 'key', 'overrides' ]
+        files = [ 'overrides' ]
     paths = Paths(path)
 
-    @staticmethod
-    def _read_address(path):
-        try:
-            return file(path).read().strip()
-        except:
-            return None
-
     def __init__(self):
-        self.keyfile = self.paths.key
-        self.address = self._read_address(self.paths.address)
+        self.secretfile = None
+        self.address = None
         self.overrides = Limits.fromfile(self.paths.overrides)
 
+    def __repr__(self):
+        return "secretfile=%s, address=%s, overrides=%s" % \
+                (`self.secretfile`, `self.address`, `self.overrides`)
+
 class ProfilePaths(Paths):
     files = [ 'dirindex', 'dirindex.conf', 'packages' ]
 
@@ -140,7 +137,7 @@ def _write_whatchanged(dest, dest_olist, dirindex, dirindex_conf,
         changes.tofile(dest)
         file(dest_olist, "w").writelines((path + "\n" for path in olist))
 
-    def __init__(self, conf, key):
+    def __init__(self, conf):
         profile = ProfilePaths(conf.profile)
         paths = ExtrasPaths(self.EXTRAS_PATH)
 
@@ -175,10 +172,9 @@ def __init__(self, conf, key):
         self.command = "duplicity " + " ".join(args)
         self.paths = paths
         self.conf = conf
-        self.key = key
 
     def run(self):
-        os.environ['PASSPHRASE'] = self.key
+        os.environ['PASSPHRASE'] = file(self.secretfile).readline().strip()
         exitcode = os.system(self.command)
         del os.environ['PASSPHRASE']
 
diff --git a/cmd_backup.py b/cmd_backup.py
index caca534..a6984ae 100755
--- a/cmd_backup.py
+++ b/cmd_backup.py
@@ -7,19 +7,9 @@
 
     Default overrides read from $CONF_OVERRIDES
 
-Resolution order for options:
-1) command line (highest precedence)
-2) configuration files ($CONF)
-
 Options:
-    --profile=PATH          base profile path
-                            default: $DEFAULT_PROFILE
-
-    --keyfile=PATH          secret keyfile
-                            default: $CONF_KEY
-
-    --address=TARGET_URL    duplicity target URL
-                            default: read from $CONF_ADDRESS
+    --address=TARGET_URL    manual backup target URL
+                            default: automatically configured via Hub
 
     -v --verbose            Turn on verbosity
     -s --simulate           Simulate operation. Don't actually backup.
@@ -34,6 +24,7 @@
 from string import Template
 
 import backup
+from registry import registry
 
 def fatal(e):
     print >> sys.stderr, "error: " + str(e)
@@ -47,35 +38,37 @@ def usage(e=None):
     tpl = Template(__doc__.strip())
     Conf = backup.BackupConf
     print >> sys.stderr, tpl.substitute(CONF=Conf.paths.path,
-                                        CONF_OVERRIDES=Conf.paths.overrides,
-                                        CONF_KEY=Conf.paths.key,
-                                        CONF_ADDRESS=Conf.paths.address,
-                                        DEFAULT_PROFILE=Conf.profile)
+                                        CONF_OVERRIDES=Conf.paths.overrides)
     sys.exit(1)
 
 def main():
     try:
         opts, args = getopt.gnu_getopt(sys.argv[1:], 'svh', 
                                        ['simulate', 'verbose', 
-                                        'profile=', 'keyfile=', 'address='])
+                                        'profile=', 'secretfile=', 'address='])
     except getopt.GetoptError, e:
         usage(e)
 
     conf = backup.BackupConf()
+    conf.secretfile = registry.path.secret
 
     opt_simulate = False
     opt_verbose = False
+
+    opt_profile = None
     for opt, val in opts:
         if opt in ('-v', '--verbose'):
             opt_verbose = True
         elif opt in ('-s', '--simulate'):
             opt_simulate = True
+
         elif opt == '--profile':
-            conf.profile = val
-        elif opt == '--keyfile':
+            opt_profile = val
+
+        elif opt == '--secretfile':
             if not exists(val):
-                usage("keyfile %s does not exist" % `val`)
-            conf.keyfile = val
+                usage("secretfile %s does not exist" % `val`)
+            conf.secretfile = val
         elif opt == '--address':
             conf.address = val
         elif opt == '-h':
@@ -84,29 +77,24 @@ def main():
     conf.overrides += args
 
     if not conf.address:
-        fatal("address not configured")
-
-    if not exists(conf.keyfile):
-        print "generating new secret key"
-        backup.Key.create(conf.keyfile)
-
-    key = backup.Key.read(conf.keyfile)
-
-    if not isdir(conf.profile):
-        fatal("profile dir %s doesn't exist" % `conf.profile`)
+        # TODO: auto-configure via Hub
+        fatal("not implemented yet")
+        conf.address = registry.hbr.address
 
     if opt_simulate:
         opt_verbose = True
 
-    b = backup.Backup(conf, key)
-    if opt_verbose:
-        print "PASSPHRASE=$(cat %s) %s" % (conf.keyfile, b.command)
+    print "backup.Backup(%s)" % (`conf`)
+
+    #b = backup.Backup(conf)
+    #if opt_verbose:
+    #    print "PASSPHRASE=$(cat %s) %s" % (conf.secretfile, b.command)
 
-    if not opt_simulate:
-        try:
-            b.run()
-        finally:
-            b.cleanup()
+    #if not opt_simulate:
+    #    try:
+    #        b.run()
+    #    finally:
+    #        b.cleanup()
 
 if __name__=="__main__":
     main()