Create an organization (serverless)
- Make an empty git repository on whatever host you already use. Give everyone who will use it read access, and give write access to anyone who will grant vaults to others, because a grant is a small file that has to be pushed. Then protect the main branch and forbid force-pushes: in serverless mode the git history is your record of every change, and branch protection is what keeps that record from being rewritten.
- Initialise the organization. One command creates the root key (the anchor everything else is checked against), enrolls you as the founding owner, and writes your key bundle. Add
--passphraseto protect your key file with one.secretsmgr org init --name "Acme Engineering" --founder priya \ --repo git@git.example.com:acme/secrets.gitIt prints a root fingerprint as a short list of words. Write it down somewhere durable and share it with your team through a channel they can trust. You will need it whenever a new person sets up their client. It also writes the root key file next to you, with instructions; the warning box below is about that file. - Create a vault and put something in it.
secretsmgr vault create dev --policy custody.requires=asserted-passphrase pwgen -s 40 1 | secretsmgr put dev/database/password secretsmgr push
Look after the root key
It is needed rarely, only for adding administrators and for rotating itself, which is exactly what makes it practical to keep offline. Put it on removable media or a security key, keep a second copy somewhere physically secure, and do not leave it on the laptop you travel with. Day-to-day work never touches it.