crunu pull

crunu pull writes the files of the chosen environments to disk. Use it for files that a program reads from a path, such as ~/.aws/credentials, or to produce one env file for systemd. For variables that a program reads from its process environment, crunu run is safer because nothing touches the disk.

crunu pull [--env PROJECT/ENVIRONMENT]... [--env-file FILE]... [--root DIR] [--env-out FILE] [--dry-run] [--allow-path PATH]... [--accept-new-paths] [--accept-restricted]

How files are written

Every file in an environment has a path relative to a home directory, for example .aws/credentials. crunu pull writes each file to that path under --root, which defaults to the home directory of the user who runs it.

• Two phases. All files are first written to temporary files next to their targets and checked. Only then are they renamed into place.
• Mode 0600 for every file.
• No symbolic links are followed.
• The previous version of each file is kept next to it with a .prev suffix.
• Paths only in the output. crunu pull prints the paths it writes, never their contents.

If two selected environments contain the same path, crunu pull stops with an error. Choose one of them with --env.

--dry-run checks the paths and prints them without changing anything.

One env file for systemd

--env-out FILE also writes the variables of the chosen environments into one env file with mode 0600. That's useful for EnvironmentFile= in a systemd unit:

crunu pull --env payments-api/production --env-out /etc/payments/env

You choose the --env-out path, so the path rules below don't apply to it.

Protected paths

Paths inside an environment are set by whoever can edit it, so the local side decides where files may go in a home directory. crunu pull refuses to write to places that would let a file run code or change how you sign in:

• shell and login files in the root of the home directory, such as .bashrc, .profile, .zshrc, .xsessionrc, .pam_environment, .netrc and .forward;
• the directories .ssh/, .gnupg/, .config/systemd/, .config/autostart/, .config/environment.d/, .config/fish/, .config/plasma-workspace/, .local/bin/, .local/share/applications/, bin/ and Library/LaunchAgents/;
• the crunu data directory ~/.config/crunu/, and the service state directory if it sits inside the home directory;
• the same directories under $XDG_CONFIG_HOME and $XDG_DATA_HOME, zsh files in $ZDOTDIR, $GNUPGHOME, and the files named by BASH_ENV and ENV when they are inside the home directory.

Letter case doesn't matter. To allow one protected path for a single run, pass --allow-path PATH, once per path. The permission isn't remembered.

New paths need your consent

A path that this crunu pull hasn't written before needs consent. In a terminal, crunu asks. Without a terminal, pass --accept-new-paths. Without consent, that path is skipped, the other files are written, and the exit code is 1.

Approved paths are remembered in pull-paths.json in the crunu data directory of the user who runs the command, tied to that home directory.

When --root points to a separate directory, these checks don't apply, because names there can't affect your shell. --allow-path and --accept-new-paths are then argument errors. crunu pull without --root never writes into the service state directory, for example when the home directory of the crunu user is /var/lib/crunu.

Network-restricted environments

The web app doesn't export network-restricted environments to files. crunu pull follows the same rule when you are signed in as a person: it writes such an environment only with your consent. In a terminal it asks before writing. Without a terminal, pass --accept-restricted. With --dry-run it shows the full plan without asking, and without the flag the exit code is 1. Without consent nothing is written, neither files nor --env-out.

Files written this way stay on the computer outside the network rule. The server can't take them back.

The machine service and service tokens are not affected: writing files is their normal job, and the flag changes nothing there. crunu asks the service on the socket whether it's a machine service or a person's session, rather than guessing from the socket path. An empty or unknown answer is treated as a person's session.

Environments it can't serve right now

Like crunu run, a granted environment that can't be served right now is refused with a reason when you name it, and skipped with a warning when you don't. Exit code 7 means the server doesn't serve its contents to your address. See crunu run for the full list of reasons.