valt0 init makes an empty vault and prints its key
Name the vault and Valt0 creates it in the current folder. You can also pass a full path to where you want to create the vault.
The .valt0 extension is added for you, so valt0 init prod writes prod.valt0.
An existing vault of that name is left alone unless you pass --force. What init makes is an empty vault with a key of its own, so overwriting one is not something to do by accident.
The key is printed once. Copy it into your password manager before that terminal window is gone, or pass --clip to copy it to the clipboard and not print it in the terminal.
valt0 init <vault>[--force][--clip]
Arguments
<vault> Required
Name for the new vault. The .valt0 extension is added, so prod writes prod.valt0. Give a path to put it somewhere else.
Flags
--force, -f Optional
Overwrite a vault of that name that is already there. Without it the command stops and the file is left exactly as it was.
--clip, -c Optional
Copy the new vault key to your clipboard.
valt0 import
valt0 import imports a vault so that it can be used by the Valt0 service
Clients work with vaults by connecting to the Valt0 service, and the service needs to import a vault to be able to open it for the clients.
If that vault has been imported before, --force replaces it.
valt0 import <vault>[--force]
Arguments
<vault> Required
The vault, by name or by path. The .valt0 extension is assumed, so prod means prod.valt0 in the current folder.
Flags
--force, -f Optional
Replace a vault that has already been imported.
valt0 store
valt0 store stores a value under a name
The input format it expects is vault:secret-name where vault is a path to a vault (or the name of a vault in the current working directory) and secret-name is the name of the secret you wish to store.
Updating a secret is the same command with --force, which is you saying you mean to write over what is already there.
valt0 store <vault>:<name>[--force]
Arguments
<vault> Required
The vault, by name or by path. The .valt0 extension is assumed, so prod means prod.valt0 in the current folder.
<name> Required
The name the secret is stored under.
Flags
--force Optional
Replace a value that is already stored under that name.
valt0 list
valt0 list prints the names of the secrets stored in the vault
It lists the secret names, when they were added and when they were last changed.
valt0 list <vault>
Arguments
<vault> Required
The vault, by name or by path. The .valt0 extension is assumed, so prod means prod.valt0 in the current folder.
valt0 get
valt0 get prints the value of a secret
The value goes to standard output, or pass --clip and Valt0 copies the value to your clipboard.
valt0 get <vault>:<name>[--clip]
Arguments
<vault> Required
The vault, by name or by path. The .valt0 extension is assumed, so prod means prod.valt0 in the current folder.
<name> Required
The name the secret is stored under.
Flags
--clip, -c Optional
Copy the secret to your clipboard.
valt0 rm
valt0 rm removes a secret from the vault
There is no undo, and if the vault is in git, older commits still hold the old value.
valt0 rm <vault>:<name>[--force]
Arguments
<vault> Required
The vault, by name or by path. The .valt0 extension is assumed, so prod means prod.valt0 in the current folder.
<name> Required
The name the secret is stored under.
Flags
--force, -f Optional
Delete the secret without asking you to confirm it first.
valt0 info
valt0 info prints information about the vault
It prints the id of the vault.
valt0 info <vault>
Arguments
<vault> Required
The vault, by name or by path. The .valt0 extension is assumed, so prod means prod.valt0 in the current folder.
valt0 status
valt0 status prints the status of the service
It takes no arguments and prints whether the Valt0 service is up on this machine.
valt0 status
valt0 deploy
valt0 deploy contains the commands needed for deploying a vault in production
Deploying a vault in production requires a key pair made of a prime key and an unlock key file.
Both the prime key and the unlock key file are generated using the generate-keys subcommand.
The prime key is provided at build time, for example when building a Docker image or provisioning a server.
The unlock key file is provided at run time, for example when a Kubernetes pod is created or a server is started.
Generate the keys for a vault that allow that vault to be used in deployment mode.
The prime key is printed to the terminal output and the unlock key file is generated in the current working directory.
--clip copies the prime key to your clipboard.
valt0 deploy generate-keys <vault>[--clip]
Arguments
<vault> Required
The vault, by name or by path. The .valt0 extension is assumed, so prod means prod.valt0 in the current folder.
Flags
--clip, -c Optional
Copy the prime key to your clipboard.
valt0 deploy prime
Primes the vault using the prime key generated by the generate-keys command, so that the vault can be used by the Valt0 service when in deployment mode.
For better security, by default, Valt0 will attempt to delete both the primed vault and the prime key from the disk in deployment mode. Pass --preserve to prevent this.
valt0 deploy prime <vault><prime-key>[--preserve]
Arguments
<vault> Required
The vault, by name or by path. The .valt0 extension is assumed, so prod means prod.valt0 in the current folder.
<prime-key> Required
The prime key valt0 deploy generate-keys made for this vault.
Flags
--preserve Optional
Keep the primed vault and the prime key after the unlock.
valt0 container
valt0 container contains a collection of commands to help when running a client from a container
These commands are strictly for using containers when developing, not for deployment.
Docker, Docker Compose and Podman are all handled.
It prints out the arguments Docker or Podman needs to establish a connection from the client app to the Valt0 host service.
You can embed this command directly: docker run $(valt0 container run) some-container-image.
valt0 container run
valt0 container compose
It provides the required connection settings, in the form a Compose project reads, so that the client apps running in containers can connect to the Valt0 host service.
--env appends them to a .env file, while --stdout prints them to the screen.
