fnox sync

• Usage: fnox sync [FLAGS] [KEYS]…

Cache remote secrets locally, encrypted with a local provider

Fetches each secret whose provider differs from the target, encrypts the value with the target encryption provider, and stores the ciphertext in the secret's sync field. Later reads decrypt that copy instead of calling the source provider. The original reference stays in place, so run sync again after source values change.

The target is --provider, else default_provider, and must be an encryption provider. The cache is written to the -c file (default: fnox.toml), the global config with --global, or with --local-file a personal fnox.local.toml to keep out of git. A full --local-file sync also removes cache entries for secrets that no longer have a source.

Arguments

• [KEYS]… — Sync only these keys

Flags

• -f --force — Write without asking for confirmation

• -g --global — Write the cache to the global config file (~/.config/fnox/config.toml)

• -n --dry-run — List the secrets that would be synced without changing anything

• -p --provider <PROVIDER> — Encryption provider to cache values with (default: default_provider)

• -s --source <SOURCE> — Sync only secrets from this source provider

• --filter <FILTER> — Sync only keys matching this regular expression

• --local-file — Write the cache to the local override file beside the config

  The file is fnox.local.toml, or .fnox.local.toml when that file exists or the config is .fnox.toml. Requires -c to be a bare fnox.toml or .fnox.toml.

• -h --help — Print help

Examples

Preview a local sync

fnox sync -p sync-age --local-file --dry-run

Cache every remote secret in fnox.local.toml

fnox sync -p sync-age --local-file

Refresh one secret

fnox sync -p sync-age --local-file DATABASE_URL

See also

• Sync