Passing passphrases as environment variables to age and KeepassXC

[lnyousif]

I know the security implications and that is another discussion, I am trying to automate the chezmoi apply when I am accessing remote machines and my passphrases are intentionally difficult to memorize.
Regarding age decryption passphrase the copy paste of complicated passphrases sometimes fails and I have to redo again and again. Is there a way for me to temporarily use environment variables to provide the info for chezmoi age decryption instead of the prompt of passphrase, I can see how its done on age pipes, but wondering if chezmoi allow me to interact with age that way.

I also would like to know if I can pass the passphrase to the KeepassXC instead of getting prompted, I know the implications of environment variables on security. I am willing to take that risk

in both cases the tool itself allow the use of env variables, but I am not sure how can i do that from within chezmoi and during chezmoi init and apply

Thanks again for amazingly useful product

[halostatue]

chezmoi will not modify the calling environment except for CHEZMOI_* variables. Therefore AGE_PASSWORD=myreallystrongpassword chezmoi apply (if that's the variable name) should work when using the age binary — but it may not work when using builtin age functionality (I emphasize may; it could work because the environment variable is handled inside the library and not inside the CLI).

[lnyousif]

I don't think that will work because in both cases it will need to be piped into the cli and not passed as environment variable , my thinking is that i use the env variable to pipe it into age something like this from which the password will be read from env variable

echo "your_password" | keepassxc-cli --pw-stdin <path_to_database>.kdbx

[halostatue]

You will need to use .age.command and a wrapper script to do this for age and .keepassxc.command with a wrapper script for keepassxc-cli.

The wrapper scripts would exactly do what you suggested, for example:

#!/usr/bin/env bash

echo "${KEEPASSXC_CLI_PASSWORD:?}" | keepassxc-cli --pw-stdin "$@"

For keepassxc, this will not work with .keepassxc.mode: builtin (this uses an internal library) and may not work with .keepassxc.mode: open (which expects stdin to work with expect-like functionality).

[lnyousif]

So you are saying this is something I can configure through chezmoi init ?

If yes you guys are beyond brilliant , Oh wait you guys are even if its not .

I will try that , thank you

[lnyousif]

@halostatue Is there any good example on how to utilize age.comand usage and where the script should live and get used ? I am going to try either way, but would appreciate some direction

[twpayne]

I would put the script in ~/.local/bin.

[lnyousif]

OK so I can add the script to my extra bash functions that I apply using chzmoi , I may have to ensure it get applied before the encryption part get executed.

@twpayne Thank you so much for the awesome product , that I am so happy i stumbled upon , despite bugging you guys with my questions :).

@halostatue THank you for your guidance