Overview
What secretree is and how the pieces fit.
secretree keeps a git repository in plaintext only on machines that hold a key. Everything that leaves them is ciphertext: history, branches, commit messages, pull requests, review comments, CI logs. The host you already use, GitHub, GitLab, an S3 bucket or a folder on a NAS, becomes a blind, durable blob store. A breach of the host yields ciphertext; a curious host learns sizes and timing.
The developer experience stays what it is: git push, git pull, open a pull request, get a review, watch CI go green, deploy. None of that needs a server that can read the code.
The pieces
| You run | What it does |
|---|---|
git push / git pull through the secretree:: remote |
Encrypts every push into a signed generation; decrypts and replays on fetch. Several people push; conflicts are the git conflicts you know. |
secretree pr … and secretree ui |
Pull requests, line comments, approvals and merges as signed git data, shown in a local web UI on 127.0.0.1:7391. |
secretree runner |
CI on a machine you control: runs the repository's own pipeline per commit and records a signed check with the log. |
secretree deploy-agent |
Pull-based deploys on the target host, gated on a green check. |
secretree backup / verify / restore |
Snapshots with a mandatory restore proof; a vault stays restorable with nothing but git, age and ssh-keygen. |
secretree share and ledger |
Show a file or diff to someone without a key through an encrypted page; every disclosure is signed and logged. |
What the host sees
Real listing of a vault, as the host stores it:
README.md
vault.json ← public keys only
repos/02ed7a372737891b/000001.bundle.age
repos/02ed7a372737891b/000001.manifest.age
repos/02ed7a372737891b/000001.manifest.age.sig
repos/02ed7a372737891b/000002.bundle.age
…
Commit messages on the vault read "backup". Branch names, commit ids, file names, authors and code exist only inside the .age files, encrypted to the members' keys.
Where to go next
- New here: Install, then Getting started.
- Want the model in your head first: Concepts and the Security model.
- Looking for a flag: Command reference.
- Something failed: Troubleshooting.
The source, the frozen on-remote format and the hand-restore procedure live in the GitHub repository.