Crate cryl 

cryl - Secret generation tool

A high-performance, sandboxed CLI tool for generating, encrypting, and managing infrastructure secrets.

Enums

CrylError

Errors that can occur during cryl operations

Format

Supported serialization formats

TlsAlgorithm

TLS key algorithm types

Functions

build_basic_constraints

Build basicConstraints string for CA certificates

build_intermediary_final_config

Build intermediary CA final config by appending CA-specific extensions

build_intermediary_request_config

Build intermediary CA request config (base config)

build_leaf_final_config

Build leaf certificate final config

build_leaf_request_config

Build leaf certificate request config

build_root_config

Build root CA config content

deserialize

Deserialize content from string based on format

deserialize_from_file

Deserialize from file path

export_copy

Copy exporter - copies a file from source to destination

export_vault

Vault exporter - exports all files in current directory to a Vault KV path

export_vault_file

Vault file exporter - exports a single file to a Vault KV path

generate_age_key

Generate an age key pair and save public + private keys

generate_cockroach_ca

Generate a CockroachDB CA (certificate + key)

generate_cockroach_client_cert

Generate a CockroachDB client certificate (for a specific user)

generate_cockroach_node_cert

Generate a CockroachDB node certificate (signed by CockroachDB CA)

generate_copy

Copy generator - copies a file from source to destination

generate_csr

Generate a Certificate Signing Request (CSR)

generate_env

Generate an environment (.env-style) file from key-value pairs

generate_id

Generate a random alphanumeric id and save it to a file

generate_json

Generate a JSON file by converting data from one format to JSON

generate_key

Generate a random alphanumeric key and save it to a file

generate_key_combine

Combine Shamir shares back into a single key

generate_key_split

Split a key into Shamir shares and save them

generate_mustache

Generate a populated Mustache template

generate_nebula_ca

Generate a Nebula CA (certificate + key)

generate_nebula_cert

Generate a Nebula node certificate (signed by a Nebula CA)

generate_password

Generate random password with argon2 hashing

generate_password_crypt3

Generate random password with yescrypt hashing (crypt(3) format)

generate_pin

Generate a numeric PIN and save it to a file

generate_private_key

Generate a private key using the specified algorithm

generate_random_alphanumeric

Generate random alphanumeric string using OpenSSL

generate_random_digits

Generate random numeric string (digits only)

generate_script

Generate and run a Nushell script

generate_self_signed_cert

Generate a self-signed certificate (for Root CA)

generate_sops

Generate SOPS-encrypted secrets from key-value inputs

generate_ssh_key

Generate an SSH key pair (ed25519) and save public + private keys

generate_text

Write a text file as part of generation

generate_tls_dhparam

Generate OpenSSL Diffie-Hellman parameters

generate_tls_intermediary

Generate a TLS Intermediate CA (key + CSR + signed cert) using EC algorithm

generate_tls_leaf

Generate a TLS Leaf certificate (key + CSR + signed cert) using EC algorithm

generate_tls_root

Generate a TLS Root CA (private key + self-signed certificate) using EC algorithm

generate_tls_rsa_intermediary

Generate a TLS Intermediate CA (key + CSR + signed cert) using RSA algorithm

generate_tls_rsa_leaf

Generate a TLS Leaf certificate (key + CSR + signed cert) using RSA algorithm

generate_tls_rsa_root

Generate a TLS Root CA (private key + self-signed certificate) using RSA algorithm

generate_toml

Generate a TOML file by converting data from one format to TOML

generate_wireguard_key

Generate a WireGuard key pair and save public + private keys

generate_yaml

Generate a YAML file by converting data from one format to YAML

import_copy

Copy importer - copies a file from source to destination

import_vault

Vault importer - imports all files from a Vault KV path

import_vault_file

Vault file importer - imports a single file from a Vault KV path

is_ip_address

Check if a string is a valid IP address (simple check)

parse_sans

Parse SANs (Subject Alternative Names) from comma-separated string Returns (dns_sans, ip_sans)

read_file_if_exists

Read file content if it exists, otherwise return None

save_atomic

Save content to a file atomically

save_private_key

Save a private key to file

save_public_file

Save a public certificate or config to file

serialize

Serialize content to string based on format

serialize_to_file

Serialize to file

should_skip_generation

Check if we should skip generation (files exist and no renew)

sign_certificate

Sign a certificate with a CA

Type Aliases

CrylResult

Result type alias for cryl operations