README.md in trocla-0.4.0 vs README.md in trocla-0.5.0

- old
+ new

@@ -163,12 +163,13 @@ Most formats are straight forward to use. Some formats require some additional options to work properly. These are documented here: ### pgsql -Password hashes for PostgreSQL servers. Requires the option `username` to be set -to the username to which the password will be assigned. +Password hashes for PostgreSQL servers. Since postgesql 10 you can use the sha256 hash, you have two options: +* Create a ssh256 hash password with option `encode: sha256` (default value) +* Create a md5 hash, the username is require for the salt key, with option `encode: md5` and `username: your_user` ### bcrypt You are able to tune the [cost factor of bcrypt](https://github.com/codahale/bcrypt-ruby#cost-factors) by passing the option `cost`. Note: ruby bcrypt does not support a [cost > 31](https://github.com/codahale/bcrypt-ruby/blob/master/lib/bcrypt/password.rb#L45). @@ -230,10 +231,21 @@ Output render options are: pubonly If set to true the sshkey format will return only the ssh public key privonly If set to true the sshkey format will return only the ssh private key +### wireguard + +This format generate a keypair for WireGuard. + +The format requires the wg binary from WireGuard userland utilities. + +Output render options are: + + pubonly If set to true the wireguard format will return only the public key + privonly If set to true the wireguard format will return only the private key + ## Installation * Debian has trocla within its sid-release: `apt-get install trocla` * For RHEL/CentOS 7 there is a [copr reporisotry](https://copr.fedoraproject.org/coprs/duritong/trocla/). Follow the help there to integrate the repository and install trocla. * Trocla is also distributed as gem: `gem install trocla` @@ -288,10 +300,12 @@ * While setting a new plain format will not only erase all other formats, but also erase/reset any expires. * Setting a value with an expires option of 0 or false, will remove any existent expiration. New backends should be tested using the provided shared example. +> **WARNING**: Vault backend use metadatas. It's set if an option is define. `expire` is automaticly change to `delete_version_after`, and you can use an interger or [format string](https://www.vaultproject.io/api-docs/secret/kv/kv-v2#parameters) + #### Moneta backends Trocla uses moneta as its default storage backend and hence can store your passwords in any of moneta's supported backends. By default it uses the yaml backend, which is configured as followed: ```YAML @@ -338,9 +352,11 @@ store_options: :mount: kv :token: s.Tok3n :address: https://vault.local ``` + +With Vault when you delete a key, you don't delete all key content. The metadatas, like history, are still here and the endpoint are not delete. If you prefere to destroy all key content you can add `:destroy: true` in the `store_options:` hash. ### Backend encryption By default trocla does not encrypt anything it stores. You might want to let Trocla encrypt all your passwords, at the moment the only supported way is SSL. Given that often trocla's store is on the same system at it's being used, there might be little sense to encrypt everything while the encryption keys are on the same system. However, if you are for example using an existing DB cluster using backend encryption you won't store any plaintext passwords within the database system.