55 lines
2 KiB
Markdown
55 lines
2 KiB
Markdown
---
|
|
title: "Encryption"
|
|
permalink: /docs/encryption
|
|
---
|
|
It can be useful to manage confidential files, like SSH keys, across multiple
|
|
systems. However, doing so would put plain text data into a Git repository,
|
|
which often resides on a public system. yadm implements a feature which can
|
|
make it easy to encrypt and decrypt a set of files so the encrypted version can
|
|
be maintained in the Git repository. This feature will only work if the gpg
|
|
command is available.
|
|
_It is recommended that you use a private repository when keeping confidential
|
|
files, even though they are encrypted._
|
|
|
|
To use this feature, a list of patterns must be created and saved as
|
|
`$HOME/.config/yadm/encrypt`. For example:
|
|
|
|
.ssh/*.key
|
|
|
|
The `yadm encrypt` command will find all files matching the patterns, and
|
|
prompt for a password. Once a password has confirmed, the matching files will be
|
|
encrypted and saved as `$HOME/.config/yadm/files.gpg`. The patterns and files.gpg
|
|
should be added to the yadm repository so they are available across multiple
|
|
systems.
|
|
|
|
yadm add .config/yadm/encrypt
|
|
yadm add .config/yadm/files.gpg
|
|
|
|
To decrypt these files later, or on another system run `yadm decrypt` and
|
|
provide the correct password.
|
|
_By default, any decrypted files will have their "group" and "others"
|
|
permissions removed._
|
|
|
|
### Asymmetric Encryption
|
|
|
|
Symmetric encryption is used by default, but asymmetric encryption may
|
|
be enabled using the `yadm.gpg-recipient` configuration. To do so, run:
|
|
|
|
yadm config yadm.gpg-recipient <recipient-address>
|
|
|
|
For this to work, `<recipient-address>` must exist in your gpg keyrings.
|
|
|
|
## transcrypt & git-crypt
|
|
|
|
transcrypt & git-crypt are tools that enable transparent encryption and
|
|
decryption of files in a Git repository. If installed, you can use either of
|
|
these tools with your yadm repository.
|
|
|
|
Simply use it normally, prefacing the `transcrypt` or `git-crypt` commands with
|
|
`yadm`.
|
|
|
|
Learn more about these tools here:
|
|
|
|
* [transcrypt](https://github.com/elasticdog/transcrypt)
|
|
* [git-crypt](https://github.com/AGWA/git-crypt)
|