Browse the docs
Guides
Export and offline copy
Download an environment as a .env file, a password-protected file or Ansible Vault, keep an offline copy you can open without the server, or install files.
Last updated
On this page
Crunu keeps your secrets on the server as ciphertext, but sometimes you need them elsewhere: in a file for a tool, on a laptop without a network, or as a safety copy in case the server is gone. Export… in an environment's header offers four formats. They differ in who can open the result and how.
Every export is recorded in the audit log as a client-reported event, without the values.
The four options
| Option | What you get | How it opens | Encrypted |
|---|---|---|---|
| Variables as a single .env | the variables of files loaded by crunu run, in one file | any tool that reads .env | no |
| Environment file with its own password (.pebble) | all files of this environment | drag it onto the Crunu page and enter its password, no server needed | yes |
| Ansible Vault (keys.vault.yml) | all files of this environment | ansible-vault view | yes, with weaker password protection |
| Offline copy (.pebble v2) | every environment of the organization you can read | your account's password and Secret Key, no server needed | yes |
Variables as a single .env
This is the same set of variables crunu run would pass to a program. The values aren't encrypted in this file. Keep it only where it's needed and delete it afterwards. If no file in the environment is marked for loading, there's nothing to export in this format.
A file with its own password
The app generates a password for the file. Save it in a password manager, and pass the file and the password to someone through different channels. To open the file, drag it onto the Crunu page and enter the password. That works without a server. This is the file format of the previous version of the product, so that version opens it too.
Ansible Vault
keys.vault.yml in the Ansible Vault 1.1 format, AES256, opens with ansible-vault view. This format protects its password more weakly than Crunu's own, so the export gets a password of its own, separate from everything else.
Offline copy
An offline copy holds, in one file, every environment of the organization that you can read. It opens with your account's password and Secret Key, without the server. Use it as a personal safety copy, for example before a server move, or to work without a network.
Download it with Offline copy on Projects or in the Export window. To open it, drag the file onto the Crunu page. Its environments are shown read-only.
Network-restricted environments
Environments restricted by a network rule can't be exported to files, and they are left out of the offline copy. The app tells you which environments were skipped. This is a client-side safeguard against accidents, not a protection against someone who holds the key.
Installing files on a computer or server
Install on computer… in an environment, or on a share link's page, downloads an install script for the files you choose. It's a POSIX shell script that:
- writes each file to its path with mode 0600;
- writes in two phases, so a failure doesn't leave half the files changed;
- keeps the previous version of each file as
.prev; - checks each file's SHA-256.
On your Mac, run it in a terminal. On a server, run it over SSH without copying it there:
# crunu-install.sh: the script you downloaded
ssh host sh -s < crunu-install.shFor servers that need secrets continuously, the agent is the better choice: it keeps them in memory, follows changes and can be revoked. See Install the agent.
Importing
- Files and folders: drag them onto an environment. See Files and variables.
- From the previous version of the product: Projects offers an import from its server or from its
.pebbleandkeys.vault.ymlfiles, with up to 100 versions of history.
There's no import from other secret managers. Export their values as files and drag those in.
What to keep in mind
- An exported file is outside Crunu. Revoking someone's access doesn't affect files they exported earlier.
- Keep offline copies and their passwords apart. An offline copy is protected by your password and Secret Key. Anyone who has your Emergency Kit and knows your password can open it.