Skip to main content

Get started using Secrets

All secrets are stored in govwifi-build, and are encrypted using GPG.

All shell commands assume you are running from within the govwifi-terraform repository since the govwifi-build repository is cloned in the .private directory of govwifi-terraform.

Tools

To use these secrets, you will need the Password Store tool installed on your machine.

You will also need an implementation of gpg installed. This will be installable under the name gnupg:

apt/brew/dnf/rpm/yum install gnupg

Getting access

Once you have installed the tools, you will need someone to re-encrypt the secrets with your public key.

Give someone your full key ID:

gpg --list-keys '<name>@digital.cabinet-office.gov.uk'

An example of a key ID is: 06D20CF70AC370DE72F49EDC992939FDD5C5144C

Please also ensure your public key is on a well known keyserver:

We suggest hkps.pool.sks-keyservers.net and keyserver.ubuntu.com, as they are known to be reliable.

gpg --keyserver keyserver.ubuntu.com --send-keys '<your key ID>'
gpg --keyserver hkps.pool.sks-keyservers.net --send-keys '<your key ID>'

Giving Access

The new joiner must first send their GPG key ID to a current member of the team .

Once the key is received, a team member must use the receive-keys option to accept it and provide the key with ultimate trust:

key_id='<their key ID>'
gpg --keyserver keyserver.ubuntu.com --receive-keys "$key_id"
echo "${key_id}:6" | gpg --import-ownertrust

To on-board the new GPG key, navigate to the .private directory in the govwifi-terraform project.

Checkout a new branch in .private:

$ git checkout -b onboarding_<NAME>_GPG_key

Append the new key to the .private/passwords/.gpg-id file:

echo "$key_id" >> '.private/passwords/.gpg-id'

Change directory to the root project (govwifi-terraform/), then re-encrypt the passwords from within the govwifi-terraform repo:

make rencrypt-passwords

Note: make commands can only be run from the root project directory.

Once the secrets have been re-encrypted, use git to commit and push the changes in the .private directory.

Raise a PR in the govwifi-build repo on Github. Ask another team member to test the encryption has worked by checking out the PR branch and testing they can decrypt the files using gpg -d.

Getting a secret

Throughout the documentation, there will be references to specific secrets stored within the password store.

To read individual secrets, run the command:

PASSWORD_STORE_DIR=<password_store_dir> pass show <secret_name>

where:

  1. <password_store_dir> is the path of the passwords directory of the govwifi-build repository on your local machine.

  2. <secret_name> is the path of the secret that you want to display. You can omit this to get a list of all secret paths.

For example, if you want to access the Staging Bastion SSH Key:

PASSWORD_STORE_DIR=.private/passwords pass show keys/govwifi-staging-bastion-key

Editing a secret

Use pass to edit your file

PASSWORD_STORE_DIR=<password_store_dir> pass edit <secret_name>

Example:

PASSWORD_STORE_DIR=~/govwifi-build/passwords pass edit your_secret.txt

Make your changes and save them. They will be re-encrypted automatically if all your gpg keys are up to date.

This page was last reviewed on 10 January 2021. It needs to be reviewed again on 10 July 2021 by the page owner #govwifi .
This page was set to be reviewed before 10 July 2021 by the page owner #govwifi. This might mean the content is out of date.