Low-budget secrets management. This is an HTTPS server which responds to incoming requests by runningsops decrypt against the secrets file you configure it to use - but only after verifying that the connecting client's certificate is signed by the CA that you configure it to use.

Usage

First, set up SOPS using age keys as identities. You will want to make an age key for the undercroft service and list it as one of the recipients in $SOPS_AGE_RECIPIENTS.

Then start the service:

SOPS_AGE_KEY_FILE=sops-secrets.age \
undercroft --ca-certificate certs/ca.crt --certificate certs/server.crt --key private/server.key --bind localhost:3000 example-secrets.enc.yaml

To test it,

curl --connect-to ::127.0.0.1:3000  --cert certs/client.crt --key private/client.key --cacert certs/ca.crt -v https://noetbook:3002