Layr

acme / shop

protected main

Overlays /

secrets

✓ you read it 3 files · 3 readers · 2 key managers · key epoch 3 · encrypted

Files

PathLast stateSizeChanged
.envRotate the Stripe test key1.2 KiB5 days ago
.env.prodAdd the production database URL0.8 KiB2 weeks ago
config/stripe.keyRotate the Stripe test key0.4 KiB5 days ago

Routed here: .env* config/*.key. New files that match go to this overlay.

Readers

ReaderKindKeySince
alicepersonage1alc…9t2qsince Oct 2 (creator)
bobpersonage1b0b…4m8xadded by alice, Oct 3
machine:executor-eu1machineSHA256:Ex9u…1mPzadded by alice, Oct 10

Key epochs

  • epoch 3 · Oct 18

    Started when alice removed dan. dan cannot open data saved after this point. 3 slots per store.

  • epoch 2 · Oct 8

    Started when alice removed machine:ci-runner-2.

  • epoch 1 · Oct 2

    Created by laptop-alice.

History

WhenWhoWhat
5 days agoalicesaved .env, config/stripe.keysigned
Oct 18aliceremoved reader dan; new key epoch 3signed
Oct 12aliceadded key manager laptop-bobsigned
Oct 10aliceadded reader machine:executor-eu1signed
$ overlay loglayr overlay log secrets

Remove reader

The next push starts a new key epoch. The removed reader cannot open anything saved after that.

● Files this reader already copied stay readable to them. Rotate real secrets (passwords, API keys) as well.
$ overlay readerslayr overlay readers secrets alice machine:executor-eu1

Add reader

Layr seals the overlay key to the reader's key in each store at the next push. No new epoch is needed.

$ overlay readerslayr overlay readers secrets alice bob machine:executor-eu1 person:carol@acme.dev=age1c4r…0p3n

Move files into this overlay

From the next state the files live in the overlay. Earlier states keep them in shared history; Layr does not rewrite history.

$ overlay movelayr overlay move secrets config/sentry.dsn

Clone shop

Get the project with all lines and states. Data is decrypted on your machine.

layr clone layr+https://cloud.acme.dev/shop