fnox reencrypt

• Usage: fnox reencrypt [FLAGS] [KEYS]…

Re-encrypt stored secrets with the current provider settings

Decrypts each matching secret stored with an encryption provider, such as age or a KMS, encrypts it again with that provider's current configuration, and writes the new ciphertext to the file that defines it. Run it after changing a provider's recipients or key, with an identity that can still decrypt the existing values.

The files of the active profiles (see fnox files) are re-encrypted too, unless you name secrets with KEYS.

fnox asks for confirmation unless you pass --force. Only the active profile's secrets are processed, so repeat with -P for other profiles. fnox sync caches on re-encrypted secrets and files are cleared; run fnox sync again to rebuild them.

Arguments

• [KEYS]… — Re-encrypt only these secrets; without them, files are re-encrypted too

Flags

• -f --force — Write without asking for confirmation
• -n --dry-run — List the secrets that would be re-encrypted without changing anything
• -p --provider <PROVIDER> — Re-encrypt only secrets stored with this provider
• --filter <FILTER> — Re-encrypt only keys matching this regular expression
• -h --help — Print help

Examples

Preview which secrets change

fnox reencrypt -p age --dry-run

Re-encrypt every age secret

fnox reencrypt -p age

Re-encrypt another profile without a prompt

fnox -P staging reencrypt -p age --force

See also

• Teams
• Age