sklp config

Raw command JSON

{
  "path": [
    "sklp",
    "config"
  ],
  "slug": "config",
  "name": "config",
  "short": "Manage a stack's config + secrets (.sklp/<stack>/config.yaml, Pulumi-style)",
  "long": "One file per stack holds plain config and encrypted secrets (secure:).\nSecrets are AES-256-GCM, keyed by SKLP_SECRETS_PASSPHRASE — the file is\ncommittable, useless without the passphrase. Deploy resolves ${VAR} from it.",
  "synopsis": "sklp config",
  "subcommands": [
    {
      "path": [
        "sklp",
        "config",
        "get"
      ],
      "slug": "config-get",
      "name": "get",
      "short": "Print a value (secrets require the passphrase; use --show)",
      "synopsis": "sklp config get [flags] [key]",
      "flags": [
        {
          "name": "stack",
          "aliases": [
            "s"
          ],
          "usage": "stack whose .sklp/<stack>/config.yaml to operate on",
          "type": "string",
          "default": "prod"
        },
        {
          "name": "show",
          "usage": "decrypt and print a secret value in clear",
          "type": "bool"
        }
      ],
      "positionals": [
        {
          "name": "key",
          "required": false
        }
      ]
    },
    {
      "path": [
        "sklp",
        "config",
        "import"
      ],
      "slug": "config-import",
      "name": "import",
      "short": "Bulk-import a dotenv file (KEY=VALUE per line); --secret encrypts all",
      "synopsis": "sklp config import [flags] [file]",
      "flags": [
        {
          "name": "stack",
          "aliases": [
            "s"
          ],
          "usage": "stack whose .sklp/<stack>/config.yaml to operate on",
          "type": "string",
          "default": "prod"
        },
        {
          "name": "secret",
          "usage": "encrypt every imported value (for a secrets file)",
          "type": "bool"
        }
      ],
      "positionals": [
        {
          "name": "file",
          "required": false
        }
      ]
    },
    {
      "path": [
        "sklp",
        "config",
        "ls"
      ],
      "slug": "config-ls",
      "name": "ls",
      "short": "List configured keys (secrets shown as <secret>)",
      "synopsis": "sklp config ls [flags]",
      "flags": [
        {
          "name": "stack",
          "aliases": [
            "s"
          ],
          "usage": "stack whose .sklp/<stack>/config.yaml to operate on",
          "type": "string",
          "default": "prod"
        }
      ]
    },
    {
      "path": [
        "sklp",
        "config",
        "passphrase"
      ],
      "slug": "config-passphrase",
      "name": "passphrase",
      "short": "Manage the secrets passphrase held in the OS vault",
      "long": "Without SKLP_SECRETS_PASSPHRASE set, sklp looks the passphrase up in a\nvault, so it need not be exported in every shell, CI runner and VM.",
      "synopsis": "sklp config passphrase",
      "subcommands": [
        {
          "path": [
            "sklp",
            "config",
            "passphrase",
            "command"
          ],
          "slug": "config-passphrase-command",
          "name": "command",
          "short": "Set the lookup command sklp runs to read the passphrase",
          "long": "Stores secrets.passphrase_command in the sklp config. {repo} in it is\nreplaced by this repo's name. Pass an empty string to clear it and fall\nback to the OS vault.",
          "synopsis": "sklp config passphrase command [command]",
          "positionals": [
            {
              "name": "command",
              "required": false
            }
          ]
        },
        {
          "path": [
            "sklp",
            "config",
            "passphrase",
            "set"
          ],
          "slug": "config-passphrase-set",
          "name": "set",
          "short": "Store the passphrase for this repo in the OS vault",
          "synopsis": "sklp config passphrase set"
        },
        {
          "path": [
            "sklp",
            "config",
            "passphrase",
            "status"
          ],
          "slug": "config-passphrase-status",
          "name": "status",
          "short": "Show where the passphrase comes from and whether it decrypts this repo",
          "synopsis": "sklp config passphrase status"
        },
        {
          "path": [
            "sklp",
            "config",
            "passphrase",
            "unset"
          ],
          "slug": "config-passphrase-unset",
          "name": "unset",
          "short": "Remove this repo's passphrase from the OS vault",
          "synopsis": "sklp config passphrase unset"
        }
      ]
    },
    {
      "path": [
        "sklp",
        "config",
        "rm"
      ],
      "slug": "config-rm",
      "name": "rm",
      "short": "Remove a key",
      "synopsis": "sklp config rm [flags] [key]",
      "flags": [
        {
          "name": "stack",
          "aliases": [
            "s"
          ],
          "usage": "stack whose .sklp/<stack>/config.yaml to operate on",
          "type": "string",
          "default": "prod"
        }
      ],
      "positionals": [
        {
          "name": "key",
          "required": false
        }
      ]
    },
    {
      "path": [
        "sklp",
        "config",
        "rotate"
      ],
      "slug": "config-rotate",
      "name": "rotate",
      "short": "Re-seal every secret under a new passphrase (new salt, current KDF cost)",
      "long": "Reads the file with SKLP_SECRETS_PASSPHRASE and rewrites it under\nSKLP_SECRETS_PASSPHRASE_NEW, drawing a fresh salt. No value is ever printed\nor passed on the command line. Also upgrades a file written at the old KDF\ncost to the current one.",
      "synopsis": "sklp config rotate [flags]",
      "flags": [
        {
          "name": "stack",
          "aliases": [
            "s"
          ],
          "usage": "stack whose .sklp/<stack>/config.yaml to operate on",
          "type": "string",
          "default": "prod"
        }
      ]
    },
    {
      "path": [
        "sklp",
        "config",
        "set"
      ],
      "slug": "config-set",
      "name": "set",
      "short": "Set a value (plain, or --secret to encrypt it)",
      "synopsis": "sklp config set [flags] [key] [value]",
      "flags": [
        {
          "name": "stack",
          "aliases": [
            "s"
          ],
          "usage": "stack whose .sklp/<stack>/config.yaml to operate on",
          "type": "string",
          "default": "prod"
        },
        {
          "name": "secret",
          "usage": "encrypt the value (stored as secure:)",
          "type": "bool"
        }
      ],
      "positionals": [
        {
          "name": "key",
          "required": false
        },
        {
          "name": "value",
          "required": false
        }
      ]
    }
  ]
}