README.md (897B)
1 # Undercroft 2 3 Low-budget secrets management. This is an HTTPS server which responds 4 to incoming requests by running`sops decrypt` against the secrets file 5 you configure it to use - but only after verifying that the connecting 6 client's certificate is signed by the CA that you configure it to use. 7 8 9 ## Usage 10 11 First, set up SOPS using [age keys as identities](https://getsops.io/docs/usage/identities/age/). You will want to make an age key for the undercroft service and list it as one of the recipients in `$SOPS_AGE_RECIPIENTS`. 12 13 Then start the service: 14 15 ``` 16 SOPS_AGE_KEY_FILE=sops-secrets.age \ 17 undercroft --ca-certificate certs/ca.crt --certificate certs/server.crt --key private/server.key --bind localhost:3000 example-secrets.enc.yaml 18 ``` 19 20 21 To test it, 22 23 ``` 24 curl --connect-to ::127.0.0.1:3000 --cert certs/client.crt --key private/client.key --cacert certs/ca.crt -v https://noetbook:3002