commit 9b358957fb0105fdae4626ea3309bbd15a3261d7 parent 6756305b5d50127fcb2fe97d03d36ee07b04c061 Author: Daniel Barlow <dan@telent.net> Date: Fri, 31 Jul 2026 17:24:37 +0100 add the merest sketch of a README Diffstat:
| A | README.md | | | 18 | ++++++++++++++++++ |
1 file changed, 18 insertions(+), 0 deletions(-)
diff --git a/README.md b/README.md @@ -0,0 +1,18 @@ +# Undercroft + +Low-budget secrets management. This is an HTTPS server which responds +to incoming requests by running`sops decrypt` against the secrets file +you configure it to use - but only after verifying that the connecting +client's certificate is signed by the CA that you configure it to use. + + +## Usage + +First, set up SOPS using [age keys as identities](https://getsops.io/docs/usage/identities/age/). You will want to make an age key for the undercroft service and list it as one of the recipients in `$SOPS_AGE_RECIPIENTS`. + +Then start the service: + +``` +SOPS_AGE_KEY_FILE=sops-secrets.age \ +undercroft --ca-certificate certs/ca.crt --certificate certs/server.crt --key private/server.key --bind localhost:3000 example-secrets.enc.yaml +```