Command line

Every command takes --key-file PATH and --prefix TEXT. Without --key-file, the key is taken from FOGLOCK_KEY, then FOGLOCK_KEY_FILE, then ./master.key.

The exit status is 0 on success and 1 on any failure.

foglock genkey

Creates a key file with mode 0400. It will not overwrite an existing file unless you pass --force.

foglock genkey
foglock genkey --key-file /etc/myapp/master.key
foglock genkey --stdout      # print the key, write nothing (e.g. to put in a CI secret)
foglock genkey --rotate      # add a new key in front of the existing ones

foglock encrypt

Asks for the secret twice at a hidden prompt and prints the encrypted value.

$ foglock encrypt
Secret:
Repeat:
@enc gAAAAABm9x2k...Q7c=

The secret cannot be passed as an argument: it would end up in your shell history and be visible to other users in the process list. To use it from a script, pipe it in:

printf '%s' "$DB_PASSWORD" | foglock encrypt --stdin

foglock decrypt

foglock decrypt "@enc gAAAAABm9x2k...Q7c="

Prints the secret. The @enc prefix is optional.

foglock validate

Checks that every encrypted value in the files decrypts with the key. It prints where each value is and whether it decrypts, never the secret itself, so it is safe to run on a server or in a deploy log.

$ foglock validate config/production.toml
config/production.toml:4: ok
config/production.toml:12: FAILED
1 of 2 values decrypt.

It fails if any value does not decrypt, and also if the files contain no values at all, which usually means the wrong file.

foglock rotate

Re-encrypts every value in the files with the newest key. Everything else in the file stays as it was, including comments and formatting.

foglock genkey --rotate
foglock rotate config/*.toml
foglock validate config/*.toml

Then delete the old key from the key file. Until you do, values encrypted with it still decrypt.

rotate decrypts every value in every file before it writes anything. If one of them fails, it changes nothing.