kindgi key

`kindgi key`

Synopsis

kindgi key <command>

Signature

Manage Ed25519 signing keys: the local pairs under ~/.kindgi/keys/, and the runtime's trust list.

Commands

Command	Description
`kindgi key create`	Generate a new Ed25519 keypair under ~/.kindgi/keys/.
`kindgi key export`	Print the PUBLIC key material for a local key.
`kindgi key list`	List local Ed25519 keys under ~/.kindgi/keys/.
`kindgi key trust`	Add a local key's public key to the runtime's trust list, so the runtime accepts deploys the key signs.
`kindgi key revoke`	Remove a key from the runtime's trust list: the runtime refuses new deploys it signs.

See also

`kindgi key create`

Synopsis

kindgi key create <keyId> [--env <name>] [--home <dir>]

Signature

Generate a new Ed25519 keypair under ~/.kindgi/keys/.

Options

Option	Default	Description
`--env <value>`	none	Also print the `signingKey` and `signerKeyId` lines to add to this env block in `kindgi.config.ts`.
`--home <value>`	`$HOME` (then the context home, then the OS home directory)	The home directory whose `.kindgi/keys/` holds the keys. Default: `$HOME`.

Every command also takes the global flags.

Examples

From Rotate the runtime's tokens and keys:

npx --yes @kindgi/cli@0.1 key create acme-selfhost-2 --env selfhost

From Self-host Kindgi:

npx --yes @kindgi/cli@0.1 key create acme-selfhost --env selfhost

See also

`kindgi key export`

Synopsis

kindgi key export <keyId> [--format=pem|base64|raw-hex] [--home <dir>]

Signature

Print the PUBLIC key material for a local key. Never exports the private key.

Options

Option	Default	Description
`--format <value>`	`pem`	The public key's encoding: `pem` (default), `base64` or `raw-hex`.
`--home <value>`	`$HOME` (then the context home, then the OS home directory)	The home directory whose `.kindgi/keys/` holds the keys. Default: `$HOME`.

Every command also takes the global flags.

Examples

Print a key's public half as PEM.

kindgi key export acme-selfhost

Print it as base64.

kindgi key export acme-selfhost --format=base64

See also

`kindgi key list`

Synopsis

kindgi key list [--home <dir>]

Signature

List local Ed25519 keys under ~/.kindgi/keys/.

Options

Option	Default	Description
`--home <value>`	`$HOME` (then the context home, then the OS home directory)	The home directory whose `.kindgi/keys/` holds the keys. Default: `$HOME`.

Every command also takes the global flags.

Examples

List the local signing keys.

kindgi key list

See also

`kindgi key trust`

Synopsis

kindgi key trust <keyId> [--label <text>] [--home <dir>]

Signature

Add a local key's public key to the runtime's trust list, so the runtime accepts deploys the key signs.

Options

Option	Default	Description
`--home <value>`	`$HOME` (then the context home, then the OS home directory)	The home directory whose `.kindgi/keys/` holds the keys. Default: `$HOME`.
`--label <value>`	none	A label the runtime keeps with the key (up to 200 characters).

Every command also takes the global flags.

Examples

From Deploy on Azure Container Apps:

npx --yes @kindgi/cli@0.1 key trust acme-dev --label dev --url "$URL"

From Deploy on Google Cloud Run:

npx --yes @kindgi/cli@0.1 key trust acme-prod --url "$URL"

See also

`kindgi key revoke`

Synopsis

kindgi key revoke <keyId> [--reason <text>]

Signature

Remove a key from the runtime's trust list: the runtime refuses new deploys it signs.

Options

Option	Default	Description
`--reason <value>`	none	Why, kept with the key as `revokedReason`.

Every command also takes the global flags.

Examples

From Rotate the runtime's tokens and keys:

npx --yes @kindgi/cli@0.1 key revoke acme-selfhost --reason "rotated to acme-selfhost-2" \

See also