dotfiles

Shell, editor and terminal configuration, the tools that go with them, and
szecret, an age-based secret manager whose store lives elsewhere.

History restarts here. What came before was not written to be read by
anyone else, and carried machine names, addresses and an encrypted secret
store; it is kept privately instead. What is left is meant to be safe on
any machine, including one whose owner is not me: see CLAUDE.md for the
rule it is written to.

1 files changed, 46 insertions, 0 deletions

diff --git a/secrets/get.sh b/secrets/get.sh
new file mode 100755
index 0000000..d88b696
--- /dev/null
+++ b/secrets/get.sh
@@ -0,0 +1,46 @@
+#!/bin/bash
+
+set -euo pipefail
+
+if [[ "$#" -gt 0 && ("$1" == "-h" || "$1" == "--help") ]]; then
+    cat <<EOF
+get: Retrieve and decrypt a secret from the store
+
+Decrypts and outputs a secret value from the global secret store.
+
+Usage:
+  get <secret-name>
+  get -h|--help
+
+Arguments:
+  secret-name    Name of the secret to retrieve
+
+The command will:
+1. Check if the secret exists in the store
+2. Ensure the private key is available
+3. Decrypt the secret using age and output to stdout
+
+Note: Exits with error if secret doesn't exist or decryption fails.
+EOF
+    exit 0
+fi
+
+this_dir="$(cd "$(dirname "$0")" && pwd)"
+source "${this_dir}/common.sh"
+
+if [[ "$#" -lt 1 ]]; then
+    >&2 echo "ERROR: Need secret name"
+    exit 1
+fi
+name="$1"
+
+file="$(file_for "${name}")"
+if ! [[ -r "${file}" ]]; then
+    >&2 echo "ERROR: Secret '$name' not found"
+    exit 1
+fi
+
+ensure_private_key
+
+age_decrypt "${private_key}" "${file}"
+