NAME
fuu
A TPM-sealed secrets vault that loads into your shell as you move between directories.
DESCRIPTION
fuu keeps a repository's secrets in one encrypted .fuu.toml and loads them into your shell as you move between directories. The file is meant to be committed and shared in public, like a sops file.
Names and values stay sealed without the vault key, and every vault key derives from your one account passphrase, which each machine keeps sealed to its TPM 2.0 chip. A copied file is useless on any other machine. There is no software fallback on purpose, the chip is the point.
A vault only loads from a folder this machine has trusted, and there is no trust on first use, so a stranger's repository cannot hand you values or reach into yours. Every vault key derives from one account passphrase under that vault's own salt, and each machine keeps the account sealed to its own TPM. A new machine runs fuu login once, and fuu rotate spins the vault key or the whole passphrase when something leaks.
FEATURES
- One .fuu.toml per repository with sealed names and values, safe to commit to public repos
- One account passphrase per person, each vault key derived from it and sealed to the TPM 2.0 of every machine, no key material on disk
- direnv style shell hooks for bash, zsh, and fish
- Explicit folder trust with a yes instead of trust on first use
- fuu edit writes back only what changed so a git diff shows exactly which line moved
- fuu run runs one command with the vault loaded and no shell integration
- Values from stdin, prompts, or arguments for fuu set
- fuu rotate for a fresh vault key, or --passphrase for a new passphrase across every vault
- Refuses shell configuring names like PATH and PROMPT_COMMAND
QUICK START
go install github.com/mizuchilabs/fuu@latest
fuu init # creates .fuu.toml, and on first use your account fuu set DATABASE_URL postgres://localhost/mydb fuu set API_KEY s3cret eval "$(fuu hook bash)" # goes into your rc file, see Shells
fuu login # the account passphrase, once per machine
fuu rotate # this vault's values leaked: fresh key, same passphrase fuu rotate --passphrase # passphrase or a machine lost: new passphrase, every vault moves
CONFIGURATION
| Name | Description |
|---|---|
| FUU_VAULT | Point at a specific vault file instead of the nearest .fuu.toml up to the git root. Also --vault. |
| VISUAL | Editor for fuu edit, falls back to EDITOR. A whitespace-separated command and its arguments, no shell and no quoting. |
| --passphrase | Flag for fuu rotate. Prints the new passphrase and reseals every vault trusted on this machine. |
RELATED
LINKS
[github]https://github.com/mizuchilabs/fuuSelf-hosting fuu is free under the Apache-2.0 license. Run it on your own iron. Commercial licensing, support, and managed offerings for businesses are on the business page.