Systemd Creds

A swamp vault backend that stores secrets encrypted at rest with systemd-creds --user, so the encrypted files are useless without your UID and this machine's id. No root, no desktop keychain daemon, no unlock step. WHAT IT DOES

Stores swamp vault secrets as AES256-GCM-encrypted .cred files via systemd-creds --user, one subdirectory per vault. Prefer it over a plaintext file or a keychain-daemon vault when you want secrets that stay encrypted on disk and are bound to your Linux user and host: a .cred file copied to another machine, or to another user, will not decrypt. It protects data at rest only — a live compromise of your user session can still decrypt secrets. Ships a companion @svendowideit/vault-migrate model so you can move or copy secrets between vaults of this (or any) type.

INSTALL

swamp extension pull @svendowideit/systemd-creds

DEPENDENCIES

None on swamp's side. Requires systemd v256+ on the host, because the --user flag was added in v256. It shells out to the systemd-creds binary; nothing else is needed.

RUN

# Create a named vault instance backed by this extension.
swamp vault create @svendowideit/systemd-creds my-vault

# Store a secret — encrypted before it reaches the filesystem.
swamp vault put my-vault MY_API_KEY

# Read a stored secret back (prompts before revealing it).
swamp vault read-secret my-vault MY_API_KEY

# List the stored key names without exposing any value.
swamp vault list-keys my-vault

# Address the shared pre-isolation store as a vault (create once). Its
# list-keys shows the keys that every pre-isolation vault used to share.
swamp vault create @svendowideit/systemd-creds legacy \
  --config '{"global":true}'

# Dry-run a move to see what would copy. `keys` is an optional JSON array;
# omit it to target every key in the source.
swamp model method run @svendowideit/vault-migrate plan vault-migrate \
  --input from=legacy --input to=my-vault \
  --input 'keys=["MY_API_KEY"]'

# Move ONE secret — this copies it to my-vault and deletes it from the
# shared store. Run this per vault to route each key to where it belongs.
swamp model method run @svendowideit/vault-migrate migrate vault-migrate \
  --input from=legacy --input to=my-vault --input 'keys=["MY_API_KEY"]'

# Move SEVERAL at once into the same vault. Add --input force=true to
# overwrite a name that already exists in the target.
swamp model method run @svendowideit/vault-migrate migrate vault-migrate \
  --input from=legacy --input to=my-vault \
  --input 'keys=["API_KEY","API_SECRET"]'

CONFIGURE

Set credstoreDir when creating the vault, or in .swamp.yaml as vault.config.credstoreDir (default ~/.config/credstore). Each vault owns <credstoreDir>/<vault name>/. Set global: true to address the shared pre-isolation directory <credstoreDir> itself — a vault created before this version keeps working through it, and per-vault reads fall back to it so existing secrets remain visible until migrated.

UPGRADE

This extension installs nothing on the host, so an upgrade has nothing to rebuild or reconcile. Refresh the pulled vault backend and its bundled @svendowideit/vault-migrate model with one idempotent command:

  swamp extension update @svendowideit/systemd-creds

WHAT IT INSTALLS

No services, daemons, triggers, or webhooks. It writes encrypted .cred files under credstoreDir when you store a secret, and reads them back on request.