Retrieve passphrase via external command

Last reviewed: 2025-12-08 / Plakar v1.0.6

To access an encrypted Kloset store, a passphrase is required. There are several ways to provide this passphrase when using the plakar command:

• Entered interactively when prompted.
• Set in the environment variable PLAKAR_PASSPHRASE before running the command.
• Given in a file with the option -keyfile, for example:

  plakar -keyfile /path/to/keyfile at /var/backups ls
  

• Stored in the configuration as plain text, with:

  plakar store add mystore location=/var/backups passphrase=mypassphrase
  

  Then use the syntax:

  plakar at "@mystore" ls
  

  to list the files in the Kloset store.

The last option is to configure an external command that will be called to retrieve the passphrase. This command could, for example, fetch the passphrase from a vault service or a password manager.

Setup a Kloset store

To set up the command, you first need to configure a Kloset store in the configuration:

plakar store add mystore location=/var/backups passphrase_cmd='echo mypassphrase'

Use the configuration

To use the configuration, use the @ syntax to refer to the Kloset store:

plakar at "@mystore" ls

When you run this command, the plakar command will call the passphrase_cmd command to retrieve the passphrase, and then use it to access the Kloset store.