I want to output secrets to a separate file using fnox set.

[iret-kawamoto]

Currently, secrets are output to the configuration file (typically fnox.toml).
If personal secrets (like temporary AWS authentication tokens) could be output to a separate file (fnox.local.toml), it would enable a workflow where shared secrets are stored in fnox.toml and personal secrets in fnox.local.toml.

If I were proficient in Rust, I should probably submit a Pull Request, but unfortunately, I'm not well-versed in Rust and implementing this would be difficult.
I would like to request consideration for a feature where, when options like -t or --target are specified, secrets are output to the specified path instead of the config file.

Thanks.

Configuration Image

fnox.toml

[providers]
age = { type = "age", recipients = ["age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p"] }

[secrets]
DATABASE_URL = { provider = "age", value = "YWdlLWVuY3J5cHRpb24uLi4=" }

fnox.local.toml (Before set execution)

[secrets]

set execution

fnox set --target fnox.local.toml --provider age AWS_SESSION_TOKEN     
Enter secret value ************
✓ Set secret AWS_SESSION_TOKEN

fnox.local.toml (After set execution)

[secrets]
AWS_SESSION_TOKEN = { provider = "age", value = "XXXXXXXXXXX" }

[MakotoTheKnight]

Using age would allow you to set the targets of whomever you want to have the secrets on your team, without exposing the secret. Exporting it to a file would defeat the purpose of encrypting it in the first place, and you're back to using .env files.

Ideally you'd follow the hierarchy of:

• Personal token in ~/fnox.local.toml, never to be checked in
• Shared secrets in ~/path/to/your/project/fnox.toml, with recipients set to either others' age public key or their SSH public key

fnox.local.toml is already in the hierarchy and you don't have to do anything special for that secret to be available to your projects.