delonix secret

Cofre de segredos cifrado em repouso — o produtor do `run --secret`.

Encrypted-at-rest secret vault — the source behind `run --secret`.

Um cofre local (SecretStore) cifrado com XChaCha20-Poly1305. Os valores NUNCA são impressos por omissão (redigidos; --reveal é opt-in). É a fonte dos container run --secret/--secret-files e do --password-secret do storage — o segredo entra uma vez, nunca fica no histórico do shell nem no manifesto.

A local vault (SecretStore) encrypted with XChaCha20-Poly1305. Values are NEVER printed by default (redacted; --reveal is opt-in). It's the source for container run --secret/--secret-files and storage's --password-secret — the secret goes in once, and never ends up in shell history or in the manifest.

📄 Implementação real em Rust: cmd/secret.rs

Usage: dlx secret [OPTIONS] <COMMAND>

Commands:
  create      Create/replace a secret from literals and/or a `.env` file
  ls          List the secrets (name + number of keys; values NEVER shown)
  inspect     Show the keys of a secret (values redacted, unless `--reveal`)
  set         Set/update keys in a secret (creates it if it does not exist)
  unset       Remove a key from a secret (or the whole secret with `--all`)
  rm          Remove a secret
  rotate-key  Rotate the host master key: re-encrypt ALL secrets with a new key. The values are preserved
  apply       Apply the `kind: Secret` documents from a manifest (declarative — creates the secret without needing `secret create` on the CLI)
  help        Print this message or the help of the given subcommand(s)

Options:
      --l18n <en|pt>  Output language: `en` (default) or `pt` (Portuguese, pt_AO). Also settable via `$DELONIX_L18N`. Global — works before any subcommand
  -h, --help          Print help

`secret apply`

Apply the kind: Secret documents from a manifest (declarative — creates the secret without needing secret create on the CLI)

Usage: dlx secret apply [OPTIONS]

Options:
  -f, --file <FILE>   
      --l18n <en|pt>  Output language: `en` (default) or `pt` (Portuguese, pt_AO). Also settable via `$DELONIX_L18N`. Global — works before any subcommand
  -h, --help          Print help

Exemplos

Criar segredos a partir de um manifesto kind: Secret

delonix secret apply -f segredos.yaml

`secret rm`

Remove a secret

Usage: dlx secret rm [OPTIONS] <NAME>

Arguments:
  <NAME>  

Options:
      --l18n <en|pt>  Output language: `en` (default) or `pt` (Portuguese, pt_AO). Also settable via `$DELONIX_L18N`. Global — works before any subcommand
  -h, --help          Print help

Exemplos

Apagar o segredo inteiro

delonix secret rm db-creds

`secret unset`

Remove a key from a secret (or the whole secret with --all)

Usage: dlx secret unset [OPTIONS] <NAME> [KEY]

Arguments:
  <NAME>  
  [KEY]   

Options:
      --all           
      --l18n <en|pt>  Output language: `en` (default) or `pt` (Portuguese, pt_AO). Also settable via `$DELONIX_L18N`. Global — works before any subcommand
  -h, --help          Print help

Exemplos

Remover UMA chave (sem apagar o segredo)

delonix secret unset db-creds password

`secret set`

Set/update keys in a secret (creates it if it does not exist)

Usage: dlx secret set [OPTIONS] <NAME> [PAIRS]...

Arguments:
  <NAME>      
  [PAIRS]...  `KEY=value` pairs

Options:
      --l18n <en|pt>  Output language: `en` (default) or `pt` (Portuguese, pt_AO). Also settable via `$DELONIX_L18N`. Global — works before any subcommand
  -h, --help          Print help

Exemplos

Acrescentar/actualizar chaves de um segredo existente

delonix secret set db-creds user=admin password=s3cr3t

`secret create`

Create/replace a secret from literals and/or a .env file

Usage: dlx secret create [OPTIONS] <NAME>

Arguments:
  <NAME>  

Options:
      --from-literal <FROM_LITERAL>    `KEY=value` pair. Repeatable
      --l18n <en|pt>                   Output language: `en` (default) or `pt` (Portuguese, pt_AO). Also settable via `$DELONIX_L18N`. Global — works before any subcommand
      --from-env-file <FROM_ENV_FILE>  Load `KEY=value` lines from a file (e.g. `.env`), or `-` to read them from stdin (the value never touches argv/process list)
  -h, --help                           Print help

Exemplos

Criar um segredo (valor via stdin, não no argv)

printf 'password=s3nha' | delonix secret create db-pass --from-env-file -

`secret ls`

List the secrets (name + number of keys; values NEVER shown)

Usage: dlx secret ls [OPTIONS]

Options:
      --l18n <en|pt>     Output language: `en` (default) or `pt` (Portuguese, pt_AO). Also settable via `$DELONIX_L18N`. Global — works before any subcommand
  -o, --output <OUTPUT>  Output format: `table` (default) or `json` (ADR-0005) [default: table] [possible values: table, json]
  -h, --help             Print help

Exemplos

Listar (valores redigidos)

delonix secret ls

`secret inspect`

Show the keys of a secret (values redacted, unless --reveal)

Usage: dlx secret inspect [OPTIONS] <NAME>

Arguments:
  <NAME>  

Options:
      --l18n <en|pt>  Output language: `en` (default) or `pt` (Portuguese, pt_AO). Also settable via `$DELONIX_L18N`. Global — works before any subcommand
      --reveal        Reveal the VALUES in cleartext (dangerous — avoid on shared terminals)
  -h, --help          Print help

Exemplos

Revelar explicitamente

delonix secret inspect db-pass --reveal

`secret rotate-key`

Rotate the host master key: re-encrypt ALL secrets with a new key. The values are preserved

Usage: dlx secret rotate-key [OPTIONS]

Options:
      --l18n <en|pt>  Output language: `en` (default) or `pt` (Portuguese, pt_AO). Also settable via `$DELONIX_L18N`. Global — works before any subcommand
  -h, --help          Print help

Exemplos

Rodar a chave-mestra (re-cifra tudo)

delonix secret rotate-key

LaboratórioLab

Cria um segredo, usa-o num container, e confirma que fica redigido por omissão.

printf 's3nha' | delonix secret create db-pass
delonix container run --rm --secret db-pass alpine env
delonix secret inspect db-pass
delonix secret inspect db-pass --reveal

Create a secret, use it in a container, and confirm it's redacted by default.

printf 's3cr3t' | delonix secret create db-pass
delonix container run --rm --secret db-pass alpine env
delonix secret inspect db-pass
delonix secret inspect db-pass --reveal

DesafioChallenge

Roda a chave do cofre com secret rotate-key e confirma que o segredo db-pass criado antes continua legível depois — a rotação não pode obrigar a recriar segredos.

Rotate the vault key with secret rotate-key and confirm the db-pass secret created earlier is still readable afterwards — rotation must never force you to recreate secrets.