Servers get their secrets at start, in memory
Install the crunu agent on a Linux server, enroll it with a single-use code and approve it after checking its fingerprint. The agent decrypts only the environments you grant and passes them to your app when it starts.
- Single-use enrollment codes
- Decrypted environments only in memory
- Works through outages for the lease, 24 hours by default
One small binary, three ways to run it
The agent is a single static binary for Linux and macOS, on amd64 and arm64, written in Go with the standard library only.
- MachineA server that runs your app signs in with its own key after enrollment. On Linux,
crunu daemonruns as a systemd service. - Service tokenA CI job signs in with
CRUNU_TOKEN. Everything stays in the process and no files are written. - PersonA developer runs
crunu loginwith password, Secret Key and a second factor.crunu unlockkeeps keys in memory,crunu lockends it early.
Enroll, compare, approve
An admin adds the machine and picks its environments. Crunu issues a single-use enrollment code; on the server, crunu enroll prints the machine’s fingerprint, and the admin approves after comparing it.
- A code that works onceValid 15 minutes by default and 24 hours at most, optionally tied to addresses. The agent accepts it only through standard input or an environment variable.
- Reuse raises an alertIf anyone presents a code that was already used, the machine is marked as a possible interception and an alert goes out.
- Operators can do it tooAn operator, who can’t see values, adds machines and requests access for them.
Your app starts with its variables
crunu run starts the program with a clean set of environment variables plus the ones from Crunu. It forwards signals, returns the program’s exit code and, with --restart on-change, restarts it when values change.
- Files, when your app reads files
crunu pullwrites them with mode 0600, keeps the previous version as.prevand refuses risky paths such as.bashrcor.ssh/. - One file for systemd
crunu pull --env-outwrites the variables into one file for anEnvironmentFile=line. - Its own credentials stay out
crunu runnever passes its own variables, such asCRUNU_TOKEN, to the program it starts.
| Code | Meaning |
|---|---|
| 0 | Success |
| 3 | Machine not enrolled, or not signed in |
| 4 | Access revoked or lease expired |
| 5 | No connection and no valid verified state |
| 6 | Signature or certificate check failed |
| 7 | Contents aren’t served to this address |
What the agent does in the background
The service checks in every minute and renews its lease every 5 minutes. Decrypted environments live only in memory and reach crunu run over a local socket.
- Through an outageIf the server can’t be reached, the agent serves the last verified state until the lease runs out, 24 hours by default.
- Revocation within minutes while onlineThe agent wipes a revoked environment from memory when it next hears from the server. Offline, it stops when the lease ends.
- It checks what the server sendsSignatures, certificates, the revocation list and rollback. On a mismatch it refuses and exits with code 6.
- Locked down on LinuxThe process is closed to other processes of the same user, core dumps are off, and the service runs in a systemd sandbox.
What a machine can still see
A machine is a legitimate reader of what you grant it. Keep grants small and leases short.
- Root sees what’s grantedRoot on that server can read everything granted to the machine. Grant only the environments and files it needs.
- Running processes keep their variablesA process started before you revoked the machine keeps its environment until it restarts.
- The service is Linux onlyOn macOS the agent is a command-line tool without a background service. There’s no Windows build.
- No Kubernetes or SDKsApps get their values through
crunu runor files fromcrunu pull.
Answers to common questions
Something else? Write to support@crunu.com
Are decrypted values written to disk?
Not by crunu run. The service keeps decrypted environments in memory and passes them to the process. Files are written only when you use crunu pull, with mode 0600.
What happens if our Crunu server is down?
The agent keeps serving the last verified state until its lease ends, 24 hours by default.
How fast does revoking a machine take effect?
Within minutes while the machine is online. The agent checks in every minute by default and wipes revoked environments from memory at its next check. Offline, it stops when the lease ends. Revoking also rotates the keys of environments the machine held.
Can one machine read another machine’s environments?
No. Each machine has its own keys and its own grants.
Does the agent run on Windows?
No. It runs on Linux and macOS, on amd64 and arm64.
Give one server its environment today
Create an account, add a machine and run your app with crunu run.