CLI Tool

HatTrick.Configuration.Tool is a small CLI, built on HatTrick.CommandLine, for encrypting, decrypting, and rekeying config files and raw values from the command line, without writing any code against ConfigEncryptor directly. Install it as a .NET global tool:

dotnet tool install -g HatTrick.Configuration.Tool

Invoke it as htlconfig:

htlconfig <command> [options]

Run htlconfig --help for the full command list, or htlconfig --help <command> (e.g. htlconfig --help rekey) for a specific command’s options; see Default Command for the full help/version/run behavior every HatTrick.CommandLine tool gets for free.

encrypt, decrypt, encrypt-value, and decrypt-value all accept -k/--key for the encryption key; if omitted, the tool prompts for it via masked console input rather than accepting it as a visible argument.

encrypt / decrypt (files)

Encrypt a plaintext JSON file to the .aes format the managers expect, or decrypt one back:

htlconfig encrypt -f app-settings.json -k <key>
# writes app-settings.aes alongside the source file

htlconfig decrypt -f app-settings.aes -k <key>
# writes app-settings.json alongside the source file

Both are non-destructive: the source file is left in place; the output is a new file with the extension swapped (.json ↔ .aes).

encrypt-value / decrypt-value (strings)

Encrypt or decrypt a raw string, for populating or inspecting an encrypted environment variable’s value, printed to stdout. Neither writes a file or sets an environment variable:

htlconfig encrypt-value -v "super-secret-api-key" -k <key>
# prints ciphertext to stdout; place it wherever your env var mechanism requires
# (shell profile, systemd unit, Docker secret, CI variable store, etc.)

htlconfig decrypt-value -v <ciphertext> -k <key>
# prints plaintext to stdout, for troubleshooting

-v/--value also prompts via masked input if omitted.

rekey / rekey-value (key rotation)

Re-encrypt a file or value under a new key, without ever writing or printing the intermediate plaintext:

htlconfig rekey -f secrets.aes -o <old-key> -n <new-key>
# decrypts with the old key, re-encrypts with the new key, writes secrets.aes in place

htlconfig rekey-value -v <ciphertext> -o <old-key> -n <new-key>
# decrypts with the old key, re-encrypts with the new key, prints the new ciphertext to stdout

-o/--old-key and -n/--new-key behave the same as -k on the other commands: omit either and the tool prompts for masked input.

Unlike decrypt/encrypt, rekey writes back to the same file (atomically, via a temp-file-then-move) instead of producing a new file with a swapped extension.

Next steps

• Encryption: the AES-GCM format these commands produce and consume
• Environment Variables: registering an encrypted variable whose value came from encrypt-value