Sign in from the terminal

As a developer you can use crunu with your own account, without a machine enrollment or a service token. You sign in once on the computer, and crunu run and crunu pull then open the environments where you have your own key or your own file copy.

crunu login

crunu login [--server URL] [--email EMAIL] [--remember-secret-key]

crunu login --server https://app.crunu.com --email jonas@kiteline.example

crunu asks for your password and Secret Key without echoing them. Without a terminal it reads them as lines from stdin: the password, then the Secret Key if it isn't saved, then the second-factor code if one is needed. Your keys are derived on this computer with PBKDF2 and 1,000,000 iterations. Neither the password nor the Secret Key is sent to the server.

The first sign-in from a computer needs a second factor. Enter a code from your authenticator app, or send an empty line to approve the sign-in from a device where you are already signed in. In that case crunu shows a 6-digit code to compare and waits for the approval. Passkeys work only in the web app, not in the terminal.

The computer is added to your account as a device named after its host, and you'll see it in Devices and sessions. If that device was revoked, crunu registers a new one.

• The server address comes from --server, then CRUNU_SERVER, then the previous sign-in.
• The email comes from --email, then the previous sign-in on the same server, then a prompt.
• Signing in to another server or another account deletes the previous local sign-in data.
• --remember-secret-key saves the Secret Key in ~/.config/crunu/secret-key with mode 0600, so later sign-ins ask only for the password.

After sign-in, crunu checks each of your organizations against the organization key pin that you signed yourself. An organization without a pin, or with a pin that doesn't match, doesn't open, and the message explains what to do. If you've seen a newer key generation or revocation list than the pin records, crunu signs the pin again with your key and saves it on the server, as the web app does.

Right after sign-in your keys stay in memory for 1 hour, so crunu run and crunu pull work without crunu unlock.

crunu unlock and crunu lock

crunu unlock [--ttl 1h]
crunu lock

crunu unlock asks for your password, and for your Secret Key if it isn't saved. It signs in with this device and starts a key holder process. The key holder keeps your session and the key that opens environment keys only in its own memory. It never gets your signing key, and its socket has mode 0600 so only you can use it. --ttl sets how long it stays, up to 12 hours. If the key holder is already running, crunu unlock only tells you how long it has left.

The key holder re-reads and re-checks environments on the server when its last check is older than 5 seconds. Network-restricted environments are asked for again on every such check, so an environment closed to your address stops being served at once.

When the time runs out, or on crunu lock, or on a signal, the key holder closes its session on the server, forgets the keys and exits.

Because the key holder has no signing key, it doesn't re-sign your organization pins. A newer key generation or revocation list it verified is added to the pin at your next crunu login or crunu unlock.

crunu logout

crunu logout

If the key holder is running, crunu logout removes this device from your account on the server, which also ends its sessions, and stops the key holder. Then it deletes the local sign-in data: the server and account details, the device key, the saved Secret Key and the rollback-protection state.

If your keys are already locked, the device stays in your account's device list. Remove it in the web app under Devices and sessions, or run crunu unlock before crunu logout.

Files in person mode

The directory is $XDG_CONFIG_HOME/crunu when that variable is set. The key holder's socket is in $XDG_RUNTIME_DIR/crunu/, or in the crunu data directory when that variable isn't set.

Network restrictions in person mode

If an environment is restricted to certain networks, the server serves its contents only to allowed addresses. That applies to owners and admins too. In the terminal, a refusal gives exit code 7 together with the address the server sees. crunu pull writes a network-restricted environment to disk only after you confirm, because files written this way stay on the computer outside the rule. See crunu pull and Network rules.