secretops 0.1.0__py3-none-any.whl

secretops/__init__.py

@@ -0,0 +1,2 @@
+def main() -> None:
+    print("Hello from secretops!")

secretops/add_client.py

@@ -0,0 +1,354 @@
+"""`secretops add`: the human client for interactive secret entry.
+
+The client holds no vault credentials. It calls the broker's human endpoints
+through the human's own broker access (SSH or sudo), shows the broker's
+validated plan, reads the value from the terminal, and sends it once, in
+the body of the submission request on the endpoint's stdin.
+"""
+
+import json
+import os
+import re
+import subprocess
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Any
+
+import yaml
+
+from secretops.human_entry import (
+    PROTOCOL_VERSION,
+    REVIEW_OUTCOMES,
+    SUBMIT_OUTCOMES,
+    InvalidValueError,
+    validate_entered_value,
+)
+from secretops.terminal_input import (
+    HiddenTerminal,
+    InputCancelled,
+    InputRejected,
+    TerminalUnavailable,
+)
+
+CLIENT_CONFIG_ENV = "SECRETOPS_CLIENT_CONFIG"
+DEFAULT_BROKER_COMMAND = "/usr/local/bin/secretops-broker"
+ENDPOINT_TIMEOUT_SECONDS = 300
+
+EXIT_CREATED = 0
+EXIT_NOT_WRITTEN = 1
+EXIT_CANCELLED = 2
+EXIT_UNKNOWN = 3
+
+SAFE_TOKEN = re.compile(r"[A-Za-z0-9_.@:+-]+")
+SAFE_PATH = re.compile(r"/[A-Za-z0-9_./-]*")
+PLAN_FIELDS = (
+    "plan_id",
+    "secret_name",
+    "env",
+    "create_mode",
+    "value_source",
+    "vault_backend",
+    "vault_domain",
+    "vault_project_id",
+    "vault_path",
+)
+SETUP_HINT = (
+    "configure human broker access in ~/.config/secretops/client.yaml "
+    "(see docs/BROKER_HOST.md, 'Human secret entry')"
+)
+
+
+class ClientError(Exception):
+    """A problem before anything was sent. Safe to print."""
+
+
+@dataclass(frozen=True)
+class BrokerAccess:
+    name: str
+    argv_prefix: tuple[str, ...]
+
+    def argv(self, *args: str) -> list[str]:
+        return [*self.argv_prefix, *args]
+
+
+def client_config_path() -> Path:
+    configured = os.environ.get(CLIENT_CONFIG_ENV)
+    if configured:
+        return Path(configured)
+    base = os.environ.get("XDG_CONFIG_HOME") or str(Path.home() / ".config")
+    return Path(base) / "secretops" / "client.yaml"
+
+
+def _broker_command(entry: dict) -> str:
+    command = entry.get("broker_command", DEFAULT_BROKER_COMMAND)
+    if not isinstance(command, str) or not SAFE_PATH.fullmatch(command):
+        raise ClientError("broker_command must be an absolute path without spaces")
+    return command
+
+
+def _access_from_entry(name: str, entry: Any) -> BrokerAccess:
+    if not isinstance(entry, dict):
+        raise ClientError(f"broker {name} is not configured correctly")
+    if "command" in entry and ("ssh" in entry or "sudo_user" in entry):
+        raise ClientError(f"broker {name}: command cannot be combined with ssh or sudo_user")
+    if not any(kind in entry for kind in ("ssh", "sudo_user", "command")):
+        raise ClientError(f"broker {name} needs ssh, sudo_user, or command")
+    if "sudo_user" in entry:
+        user = entry["sudo_user"]
+        if not isinstance(user, str) or not SAFE_TOKEN.fullmatch(user) or user.startswith("-"):
+            raise ClientError(f"broker {name}: sudo_user is not valid")
+    if "ssh" in entry:
+        destination = entry["ssh"]
+        if not isinstance(destination, str) or not SAFE_TOKEN.fullmatch(destination) or destination.startswith("-"):
+            raise ClientError(f"broker {name}: ssh must be a host or user@host")
+        remote = (_broker_command(entry),)
+        if "sudo_user" in entry:
+            # Personal account on the broker host, then sudo to the broker
+            # user. Without a remote PTY sudo cannot ask for a password, so
+            # -n fails instead of prompting; a narrow sudoers rule is needed.
+            remote = ("sudo", "-n", "-u", entry["sudo_user"], "--", *remote)
+        # No remote PTY and no forwarding; host-key checking stays as configured.
+        prefix = (
+            "ssh", "-T",
+            "-o", "RequestTTY=no",
+            "-o", "ForwardAgent=no",
+            "-o", "ForwardX11=no",
+            "-o", "ClearAllForwardings=yes",
+            destination,
+            *remote,
+        )
+    elif "sudo_user" in entry:
+        prefix = ("sudo", "-u", entry["sudo_user"], "--", _broker_command(entry))
+    else:
+        command = entry["command"]
+        if not isinstance(command, list) or not command or not all(
+            isinstance(part, str) and part for part in command
+        ):
+            raise ClientError(f"broker {name}: command must be a list of arguments")
+        prefix = tuple(command)
+    return BrokerAccess(name=name, argv_prefix=prefix)
+
+
+def load_broker_access(selected: str | None) -> BrokerAccess:
+    path = client_config_path()
+    try:
+        data = yaml.safe_load(path.read_text(encoding="utf-8")) or {}
+    except FileNotFoundError as error:
+        raise ClientError(f"no broker is configured; {SETUP_HINT}") from error
+    except (OSError, yaml.YAMLError) as error:
+        raise ClientError(f"cannot read {path}") from error
+    brokers = data.get("brokers") if isinstance(data, dict) else None
+    if not isinstance(brokers, dict) or not brokers:
+        raise ClientError(f"no broker is configured; {SETUP_HINT}")
+    name = selected or data.get("default_broker")
+    if name is None:
+        if len(brokers) != 1:
+            raise ClientError(
+                "several brokers are configured; choose one with --broker: "
+                + ", ".join(sorted(str(key) for key in brokers))
+            )
+        name = next(iter(brokers))
+    if name not in brokers:
+        raise ClientError(f"broker {name} is not configured")
+    return _access_from_entry(str(name), brokers[name])
+
+
+def safe_text(value: Any) -> str:
+    """Render broker text without control characters that could alter the terminal."""
+    return "".join(
+        character if character.isprintable() else "?" for character in str(value)
+    )
+
+
+def _parse_response(stdout: bytes) -> dict[str, Any]:
+    text = stdout.decode("utf-8")
+    if not text.endswith("\n") or "\n" in text[:-1]:
+        raise ValueError("response is not one line")
+    data = json.loads(text)
+    if not isinstance(data, dict) or data.get("protocol") != PROTOCOL_VERSION:
+        raise ValueError("unsupported response")
+    if not isinstance(data.get("outcome"), str) or not isinstance(data.get("message"), str):
+        raise ValueError("unexpected response")
+    return data
+
+
+def parse_review_response(stdout: bytes) -> dict[str, Any]:
+    data = _parse_response(stdout)
+    if set(data) != {"protocol", "outcome", "message", "plan", "digest", "atomic_create"}:
+        raise ValueError("unexpected review response")
+    if data["outcome"] not in REVIEW_OUTCOMES:
+        raise ValueError("unexpected review outcome")
+    plan = data["plan"]
+    if plan is not None and (
+        not isinstance(plan, dict)
+        or set(plan) != set(PLAN_FIELDS)
+        or not all(isinstance(value, str) for value in plan.values())
+    ):
+        raise ValueError("unexpected plan metadata")
+    if data["outcome"] == "ready" and (
+        plan is None
+        or not isinstance(data["digest"], str)
+        or not isinstance(data["atomic_create"], bool)
+    ):
+        raise ValueError("incomplete review")
+    return data
+
+
+def parse_submit_response(stdout: bytes) -> dict[str, Any]:
+    data = _parse_response(stdout)
+    if set(data) != {"protocol", "outcome", "message", "plan_id"}:
+        raise ValueError("unexpected submit response")
+    if data["outcome"] not in SUBMIT_OUTCOMES:
+        raise ValueError("unexpected submit outcome")
+    return data
+
+
+def call_review(access: BrokerAccess, args: list[str]) -> dict[str, Any]:
+    """Call prepare-add or review-add. Nothing secret is sent."""
+    try:
+        result = subprocess.run(
+            access.argv(*args),
+            stdin=subprocess.DEVNULL,
+            stdout=subprocess.PIPE,
+            timeout=ENDPOINT_TIMEOUT_SECONDS,
+            check=False,
+        )
+    except (OSError, subprocess.TimeoutExpired) as error:
+        raise ClientError(f"cannot reach broker {access.name}") from error
+    try:
+        return parse_review_response(result.stdout)
+    except (UnicodeDecodeError, ValueError) as error:
+        raise ClientError(
+            f"broker {access.name} did not return a valid review "
+            f"(exit status {result.returncode}); check the human broker access"
+        ) from error
+
+
+def call_submit(access: BrokerAccess, request: bytes) -> dict[str, Any] | None:
+    """Send the submission once. None means the outcome is unknown."""
+    try:
+        result = subprocess.run(
+            access.argv("submit-add"),
+            input=request,
+            stdout=subprocess.PIPE,
+            timeout=ENDPOINT_TIMEOUT_SECONDS,
+            check=False,
+        )
+    except (OSError, subprocess.TimeoutExpired):
+        return None
+    try:
+        return parse_submit_response(result.stdout)
+    except (UnicodeDecodeError, ValueError):
+        return None
+
+
+def operation_text(atomic_create: bool) -> str:
+    if atomic_create:
+        return "create only; an existing secret is never replaced"
+    return "create only; refused if present at the final check"
+
+
+def summary_lines(access: BrokerAccess, review: dict[str, Any]) -> list[str]:
+    plan = {key: safe_text(value) for key, value in review["plan"].items()}
+    return [
+        f"Broker:      {safe_text(access.name)}",
+        f"Vault:       {plan['vault_backend']} / {plan['vault_project_id']} / {plan['env']} / {plan['vault_path']}",
+        f"Server:      {plan['vault_domain']}",
+        f"Secret:      {plan['secret_name']}",
+        f"Operation:   {operation_text(review['atomic_create'])}",
+        f"Plan:        {plan['plan_id']}",
+    ]
+
+
+def unknown_lines(plan_id: str | None) -> list[str]:
+    lines = ["Write outcome is unknown. Do not submit again yet."]
+    if plan_id:
+        lines.append(
+            f"Check broker status for plan {safe_text(plan_id)}; "
+            "if unresolved, ask the operator to verify it."
+        )
+    return lines
+
+
+def run_add(echo, *, access: BrokerAccess, review_args: list[str],
+            terminal_factory=HiddenTerminal) -> int:
+    """Review, read the value, confirm, submit. Returns the exit code.
+
+    `echo` prints one line of safe text to the user.
+    """
+    review = call_review(access, review_args)
+    outcome = review["outcome"]
+    if outcome == "ready":
+        for line in summary_lines(access, review):
+            echo(line)
+    if outcome == "exists":
+        echo("Secret already exists. Nothing was written.")
+        return EXIT_NOT_WRITTEN
+    if outcome != "ready":
+        echo(f"Not saved: {safe_text(review['message'])}")
+        return EXIT_NOT_WRITTEN
+    plan_id = review["plan"]["plan_id"]
+    echo("")
+    echo("Checks passed. The secret is currently absent.")
+
+    try:
+        with terminal_factory() as terminal:
+            try:
+                value = terminal.read_hidden("Value (hidden): ")
+                validate_entered_value(value)
+            except (InputRejected, InvalidValueError) as error:
+                terminal.print(f"Not saved: {error}")
+                terminal.print(f"Nothing was sent. The plan {plan_id} can be used again.")
+                return EXIT_NOT_WRITTEN
+            for line in summary_lines(access, review)[3:5]:
+                terminal.print(line)
+            if not terminal.confirm("Save? [y/N]: "):
+                terminal.print("Cancelled. Nothing was sent.")
+                return EXIT_CANCELLED
+    except InputCancelled:
+        echo("Cancelled. Nothing was sent.")
+        return EXIT_CANCELLED
+    except TerminalUnavailable as error:
+        echo(f"Not saved: {error}. Nothing was sent.")
+        return EXIT_NOT_WRITTEN
+    except KeyboardInterrupt:
+        echo("Cancelled. Nothing was sent.")
+        return EXIT_CANCELLED
+
+    request = (
+        json.dumps(
+            {
+                "protocol": PROTOCOL_VERSION,
+                "plan_id": plan_id,
+                "digest": review["digest"],
+                "value": value,
+            },
+            ensure_ascii=False,
+            separators=(",", ":"),
+        )
+        + "\n"
+    ).encode("utf-8")
+    del value
+    try:
+        response = call_submit(access, request)
+    except KeyboardInterrupt:
+        response = None
+    del request
+    if response is None:
+        for line in unknown_lines(plan_id):
+            echo(line)
+        return EXIT_UNKNOWN
+    result = response["outcome"]
+    if result == "created":
+        echo("")
+        echo("Saved and verified.")
+        return EXIT_CREATED
+    if result == "exists":
+        echo("Secret already exists. Nothing was written by this invocation.")
+        return EXIT_NOT_WRITTEN
+    if result == "unknown":
+        for line in unknown_lines(plan_id):
+            echo(line)
+        return EXIT_UNKNOWN
+    echo(f"Not saved: {safe_text(response['message'])}")
+    return EXIT_NOT_WRITTEN

secretops/audit.py

@@ -0,0 +1,42 @@
+import json
+import os
+from typing import Any
+from datetime import datetime, timezone
+from pathlib import Path
+
+DEFAULT_AUDIT_PATH = Path(".audit/secretops.jsonl")
+AUDIT_PATH_ENV = "SECRETOPS_AUDIT_PATH"
+
+
+def audit_path() -> Path:
+    return Path(os.environ.get(AUDIT_PATH_ENV, DEFAULT_AUDIT_PATH))
+
+
+def write_audit_event(
+    *,
+    action: str,
+    secret_name: str,
+    env: str,
+    status: str,
+    plan_id: str | None = None,
+    details: dict[str, Any] | None = None,
+) -> None:
+    """Append one audit event. `details` may carry secret names and metadata
+    only, never values."""
+    event = {
+        "timestamp": datetime.now(timezone.utc).isoformat(),
+        "action": action,
+        "secret_name": secret_name,
+        "env": env,
+        "status": status,
+        "secret_value_logged": False,
+    }
+    if plan_id is not None:
+        event["plan_id"] = plan_id
+    if details:
+        event.update(details)
+
+    path = audit_path()
+    path.parent.mkdir(parents=True, exist_ok=True)
+    with path.open("a", encoding="utf-8") as audit_file:
+        audit_file.write(json.dumps(event, separators=(",", ":")) + "\n")

secretops/broker_config.py

@@ -0,0 +1,294 @@
+"""Human-only helper that writes the broker's broker.env.
+
+Run as root from the human's own terminal (installed as
+/usr/local/sbin/secretops-configure). The broker wrapper sources broker.env
+as shell, so this module never sources it: it reads only lines in the exact
+form it writes itself, KEY=<shlex.quote(value)>, for known keys, and writes
+every value with shlex.quote. Errors name a line number, never its content.
+
+    secretops-configure                 # destination settings and token
+    secretops-configure --token-only    # replace only the token
+
+The installer uses --init once to write the initial file without a token.
+No provider is called and no credential is printed.
+"""
+
+import argparse
+import getpass
+import ipaddress
+import os
+import pwd
+import re
+import shlex
+import stat
+import sys
+import tempfile
+import warnings
+from collections.abc import Callable
+from pathlib import Path
+from urllib.parse import urlsplit
+
+BROKER_ENV = Path("/opt/secretops/broker.env")
+BROKER_USER = "secretops-broker"
+TOKEN_KEY = "INFISICAL_TOKEN"
+# Written in this order; unknown keys are refused.
+KNOWN_KEYS = (
+    "SECRETOPS_BIN",
+    "INFISICAL_DOMAIN",
+    TOKEN_KEY,
+    "SECRETOPS_INFISICAL_PROJECT_ID",
+    "SECRETOPS_INFISICAL_PATH",
+    "SECRETOPS_INFISICAL_BIN",
+    "SECRETOPS_GH_BIN",
+    "SECRETOPS_PROVIDER_TIMEOUT_SECONDS",
+    "SECRETOPS_PLAN_DIR",
+    "SECRETOPS_AUDIT_PATH",
+    "SECRETOPS_POLICY_PATH",
+)
+# Fixed by the installed layout; --init writes them.
+LAYOUT_DEFAULTS = {
+    "SECRETOPS_BIN": "/opt/secretops/bin/secretops",
+    "SECRETOPS_INFISICAL_PATH": "/",
+    "SECRETOPS_PLAN_DIR": "/opt/secretops/plans",
+    "SECRETOPS_AUDIT_PATH": "/opt/secretops/audit/secretops.jsonl",
+    "SECRETOPS_POLICY_PATH": "/opt/secretops/policy.yaml",
+}
+LINE = re.compile(r"(?P<key>[A-Z][A-Z0-9_]*)=(?P<raw>.*)")
+PROJECT_ID = re.compile(r"[A-Za-z0-9_-]+")
+VAULT_PATH = re.compile(r"/[A-Za-z0-9_./-]*")
+
+
+class ConfigError(Exception):
+    """Safe to print: fixed text, line numbers, and key names only."""
+
+
+def parse(text: str) -> dict[str, str]:
+    values: dict[str, str] = {}
+    for number, line in enumerate(text.splitlines(), start=1):
+        if not line.strip() or line.startswith("#"):
+            continue
+        match = LINE.fullmatch(line)
+        if not match or match["key"] not in KNOWN_KEYS:
+            raise ConfigError(f"broker.env line {number}: unsupported line")
+        if match["key"] in values:
+            raise ConfigError(f"broker.env line {number}: duplicate {match['key']}")
+        try:
+            parts = shlex.split(match["raw"])
+        except ValueError:
+            parts = None
+        # Only the canonical form this module writes is accepted, so a value
+        # read here means exactly what the shell will see when sourcing it.
+        if parts is None or len(parts) > 1:
+            raise ConfigError(f"broker.env line {number}: unsupported value syntax")
+        value = parts[0] if parts else ""
+        if shlex.quote(value) != match["raw"]:
+            raise ConfigError(f"broker.env line {number}: unsupported value syntax")
+        values[match["key"]] = value
+    return values
+
+
+def serialize(values: dict[str, str]) -> str:
+    lines = []
+    for key in KNOWN_KEYS:
+        if key in values:
+            value = values[key]
+            if any(char in value for char in "\n\r\0"):
+                raise ConfigError(f"{key}: value must be a single line")
+            lines.append(f"{key}={shlex.quote(value)}")
+    return "\n".join(lines) + "\n"
+
+
+def validate_domain(value: str) -> str:
+    parts = urlsplit(value)
+    if (
+        parts.scheme not in ("http", "https")
+        or not parts.hostname
+        or parts.username
+        or parts.password
+        or parts.query
+        or parts.fragment
+        or any(char.isspace() for char in value)
+    ):
+        raise ConfigError("vault URL must be http(s)://host[:port][/path] without credentials")
+    return value.rstrip("/")
+
+
+def is_unencrypted_remote(domain: str) -> bool:
+    parts = urlsplit(domain)
+    if parts.scheme != "http":
+        return False
+    host = parts.hostname or ""
+    if host == "localhost":
+        return False
+    try:
+        return not ipaddress.ip_address(host).is_loopback
+    except ValueError:
+        return True
+
+
+def validate_project_id(value: str) -> str:
+    if not PROJECT_ID.fullmatch(value):
+        raise ConfigError("project ID may contain only letters, digits, '-' and '_'")
+    return value
+
+
+def validate_vault_path(value: str) -> str:
+    if not VAULT_PATH.fullmatch(value) or "//" in value or "/../" in value + "/":
+        raise ConfigError("vault folder path must be absolute, for example / or /app")
+    return value
+
+
+def validate_token(value: str) -> str:
+    if not value or any(char.isspace() or char == "\0" for char in value):
+        raise ConfigError("token must be one non-empty line without spaces; nothing was changed")
+    return value
+
+
+def validate_executable(value: str) -> str:
+    path = Path(value)
+    if not path.is_absolute() or not path.is_file() or not os.access(path, os.X_OK):
+        raise ConfigError(f"{value} is not an absolute path to an executable file")
+    return value
+
+
+def read_env(path: Path, owner_uid: int) -> dict[str, str]:
+    try:
+        fd = os.open(path, os.O_RDONLY | os.O_NOFOLLOW)
+    except FileNotFoundError:
+        raise ConfigError(f"{path} does not exist; run the installer first") from None
+    except OSError:
+        raise ConfigError(f"{path} cannot be opened (symlinks are refused)") from None
+    with os.fdopen(fd, encoding="utf-8") as handle:
+        info = os.fstat(handle.fileno())
+        if not stat.S_ISREG(info.st_mode) or info.st_uid != owner_uid or info.st_mode & 0o077:
+            raise ConfigError(f"{path} must be a regular file owned by the broker user, mode 0600")
+        try:
+            return parse(handle.read())
+        except UnicodeDecodeError:
+            raise ConfigError(f"{path} is not valid UTF-8") from None
+
+
+def write_env(path: Path, values: dict[str, str], owner_uid: int, owner_gid: int) -> None:
+    content = serialize(values)
+    fd, temp_name = tempfile.mkstemp(prefix=".broker.env.", dir=path.parent)
+    try:
+        with os.fdopen(fd, "w", encoding="utf-8") as handle:
+            os.fchmod(handle.fileno(), 0o600)
+            os.fchown(handle.fileno(), owner_uid, owner_gid)
+            handle.write(content)
+            handle.flush()
+            os.fsync(handle.fileno())
+        os.replace(temp_name, path)
+        temp_name = None
+        directory = os.open(path.parent, os.O_RDONLY)
+        try:
+            os.fsync(directory)
+        finally:
+            os.close(directory)
+    finally:
+        if temp_name is not None:
+            os.unlink(temp_name)
+
+
+def hidden_input(prompt: str) -> str:
+    """Read the token with echo off, or refuse before reading anything.
+
+    getpass falls back to visible input (with a GetPassWarning) when it
+    cannot turn echo off; that warning is raised as an error here, before
+    the fallback reads a single character.
+    """
+    with warnings.catch_warnings():
+        warnings.simplefilter("error", getpass.GetPassWarning)
+        try:
+            return getpass.getpass(prompt)
+        except getpass.GetPassWarning:
+            raise ConfigError("hidden input is not available on this terminal; nothing was changed") from None
+
+
+def ask(prompt: str, current: str, validate: Callable[[str], str], read: Callable[[str], str]) -> str:
+    shown = f" [{current}]" if current else ""
+    answer = read(f"{prompt}{shown}: ").strip() or current
+    if not answer:
+        raise ConfigError(f"{prompt} is required; nothing was changed")
+    return validate(answer)
+
+
+def configure(
+    values: dict[str, str],
+    *,
+    token_only: bool,
+    read: Callable[[str], str] = input,
+    read_hidden: Callable[[str], str] = hidden_input,
+) -> dict[str, str]:
+    updated = dict(values)
+    if not token_only:
+        updated["INFISICAL_DOMAIN"] = ask(
+            "Vault URL", values.get("INFISICAL_DOMAIN", ""), validate_domain, read
+        )
+        updated["SECRETOPS_INFISICAL_PROJECT_ID"] = ask(
+            "Project ID", values.get("SECRETOPS_INFISICAL_PROJECT_ID", ""), validate_project_id, read
+        )
+        updated["SECRETOPS_INFISICAL_PATH"] = ask(
+            "Vault folder path", values.get("SECRETOPS_INFISICAL_PATH", "/"), validate_vault_path, read
+        )
+    has_token = bool(values.get(TOKEN_KEY))
+    hint = " (hidden; Enter keeps the current token)" if has_token and not token_only else " (hidden)"
+    token = read_hidden(f"Machine identity access token{hint}: ")
+    if token or token_only or not has_token:
+        updated[TOKEN_KEY] = validate_token(token)
+    return updated
+
+
+def init_values(domain: str, infisical_bin: str, gh_bin: str | None) -> dict[str, str]:
+    values = dict(LAYOUT_DEFAULTS)
+    values["INFISICAL_DOMAIN"] = validate_domain(domain)
+    values["SECRETOPS_INFISICAL_BIN"] = validate_executable(infisical_bin)
+    if gh_bin:
+        values["SECRETOPS_GH_BIN"] = validate_executable(gh_bin)
+    return values
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(prog="secretops-configure", description=__doc__.split("\n\n")[0])
+    parser.add_argument("--token-only", action="store_true", help="replace only the access token")
+    parser.add_argument("--init", action="store_true", help=argparse.SUPPRESS)
+    parser.add_argument("--domain", help=argparse.SUPPRESS)
+    parser.add_argument("--infisical-bin", help=argparse.SUPPRESS)
+    parser.add_argument("--gh-bin", help=argparse.SUPPRESS)
+    args = parser.parse_args(argv)
+    try:
+        if os.geteuid() != 0:
+            raise ConfigError("run with sudo from your own terminal, not from an agent session")
+        account = pwd.getpwnam(BROKER_USER)
+        if args.init:
+            if BROKER_ENV.exists() or BROKER_ENV.is_symlink():
+                raise ConfigError(f"{BROKER_ENV} already exists")
+            if not args.domain or not args.infisical_bin:
+                raise ConfigError("--init needs --domain and --infisical-bin")
+            write_env(BROKER_ENV, init_values(args.domain, args.infisical_bin, args.gh_bin),
+                      account.pw_uid, account.pw_gid)
+            return 0
+        if not (sys.stdin.isatty() and sys.stdout.isatty()):
+            raise ConfigError("an interactive terminal is required; do not pipe credentials")
+        values = read_env(BROKER_ENV, account.pw_uid)
+        updated = configure(values, token_only=args.token_only)
+        write_env(BROKER_ENV, updated, account.pw_uid, account.pw_gid)
+    except ConfigError as error:
+        print(f"secretops-configure: {error}", file=sys.stderr)
+        return 1
+    except KeyError:
+        print(f"secretops-configure: broker user {BROKER_USER} does not exist", file=sys.stderr)
+        return 1
+    except (EOFError, KeyboardInterrupt):
+        print("\nsecretops-configure: cancelled; nothing was changed", file=sys.stderr)
+        return 2
+    print("Broker configuration saved. No credential was displayed.")
+    if is_unencrypted_remote(updated["INFISICAL_DOMAIN"]):
+        print("WARNING: the vault URL uses unencrypted HTTP to a non-loopback host.")
+    print("Check it: sudo -u secretops-broker /usr/local/bin/secretops-broker "
+          "check-vault-read --name <EXISTING_TEST_SECRET> --env dev")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())