secretctl

secretctl manages local Docker secret files from a tracked TOML manifest. Secret values stay in secrets/ and are ignored by git; only the manifest and the ignore rule are meant to be committed.

Installation

pipx install git+https://github.com/DarkbreakerDE/secretctl.git@v0.1.0

Commands

secretctl init
secretctl add <name> --manual
secretctl add <name> --generate --bytes <n>
secretctl set <name>
secretctl rotate <name>
secretctl list
secretctl remove <name>
secretctl check
secretctl apply

Manifest

secretctl init creates:

secrets/
  .gitignore
  secret.manifest.toml

Example manifest:

version = 1

[secrets.db_password]
type = "generated"
bytes = 32
file = "db_password"

[secrets.api_token]
type = "manual"
file = "api_token"

Generated secrets are written as base64url text with entropy from the configured byte count. add and apply never overwrite existing secret files. Use set to set any secret manually, without changing its manifest type. Use rotate only for generated secrets; manual secrets get an error pointing to set.