dotfiles

Shell, editor and terminal configuration, the tools that go with them, and
szecret, an age-based secret manager whose store lives elsewhere.

History restarts here. What came before was not written to be read by
anyone else, and carried machine names, addresses and an encrypted secret
store; it is kept privately instead. What is left is meant to be safe on
any machine, including one whose owner is not me: see CLAUDE.md for the
rule it is written to.

1 files changed, 75 insertions, 0 deletions

diff --git a/secrets/create-local.sh b/secrets/create-local.sh
new file mode 100755
index 0000000..ffebd9c
--- /dev/null
+++ b/secrets/create-local.sh
@@ -0,0 +1,75 @@
+#!/bin/bash
+
+set -euo pipefail
+
+if [[ "$#" -gt 0 && ("$1" == "-h" || "$1" == "--help") ]]; then
+    cat <<EOF
+create-local: Create a new localized secret store
+
+Creates a new age private key for a localized secret store and initializes
+a directory with metadata for automatic store discovery.
+
+If the store key already exists but the directory lacks metadata, this command
+will add the metadata file (useful for migrating existing stores).
+
+Usage:
+  create-local <store-name> <directory>
+  create-local -h|--help
+
+Arguments:
+  store-name    Name of the local store to create
+  directory     Directory to initialize with store metadata
+
+The command will:
+1. Check if the directory already has a .szecret metadata file
+2. If the store key doesn't exist, generate a new age private key
+3. Write the store name to <directory>/.szecret
+
+Note: This command will refuse to overwrite existing metadata.
+EOF
+    exit 0
+fi
+
+this_dir="$(cd "$(dirname "$0")" && pwd)"
+source "${this_dir}/common.sh"
+
+if [[ "$#" -lt 2 ]]; then
+    >&2 echo "ERROR: Need local store name and directory"
+    exit 1
+fi
+
+local_store_name="$1"
+target_dir="$2"
+metadata_file="${target_dir}/.szecret"
+local_key_name="$(local_key_name "${local_store_name}")"
+local_key_file="$(file_for "${local_key_name}")"
+
+key_exists=false
+metadata_exists=false
+
+[[ -r "${local_key_file}" ]] && key_exists=true
+[[ -e "${metadata_file}" ]] && metadata_exists=true
+
+# Check if metadata already exists
+if [[ "${metadata_exists}" == "true" ]]; then
+    >&2 echo "ERROR: Directory already has .szecret metadata"
+    exit 1
+fi
+
+# Ensure target directory exists
+mkdir -p "${target_dir}"
+
+ensure_age
+
+if [[ "${key_exists}" == "false" ]]; then
+    # New store: create key first
+    age-keygen 2>/dev/null | "${this_dir}/put.sh" "${local_key_name}"
+fi
+
+# Get public key and write metadata
+local_pubkey="$(get_local_public_key "${local_store_name}")"
+write_local_metadata "${metadata_file}" "${local_store_name}" "${local_pubkey}"
+
+if [[ "${key_exists}" == "true" ]]; then
+    >&2 echo "Added metadata for existing store '${local_store_name}'"
+fi