Trusted Peers setup

Overview

trusted-owner-ssh is the default mode. It uses SCP/SSH for transport so any machine you can SSH into is automatically a sync peer. No server process is needed — syncenv calls SSH directly.

Step 1 — Set up your first device

Install syncenv and initialize on the machine that already has the secrets you want to share.

# install syncenv
curl -fsSL https://syncenv.yuvrajthapa.com/install.sh | sudo bash

# verify
syncenv --version

# set mode (trusted-owner-ssh is the default, but be explicit)
syncenv mode set trusted-owner-ssh --yes

# initialize the secrets file
syncenv init

# add your secrets
syncenv add OPENAI_API_KEY="sk-abc123xyz"
syncenv add DATABASE_URL="postgres://user:pass@localhost/db"

# check status
syncenv status

At this point your first device is ready. Secrets are stored at ~/.config/syncenv/.secrets.env.

Step 2 — Add a second device

Install syncenv on the new machine and set up SSH access so both machines can reach each other.

2a — Install syncenv on the new device

# on the new machine
curl -fsSL https://syncenv.yuvrajthapa.com/install.sh | sudo bash
syncenv mode set trusted-owner-ssh --yes
syncenv init

2b — Set up SSH keys between the two machines

Both machines need passwordless SSH access to each other. Run from each machine:

# from the NEW machine → first device
ssh-copy-id user@first-device.local

# from the FIRST device → new machine
ssh-copy-id user@new-device.local

Verify SSH works in both directions:

ssh user@first-device.local "echo ok"
ssh user@new-device.local "echo ok"

2c — Discover and sync

# on the new machine — discover peers
syncenv discover

# sync secrets from the first device
syncenv sync

The new machine will discover the first device via mDNS, fetch secrets over SCP, and merge them locally. Both machines now have identical secrets.

Since v4, peers are identified per-user (user@host), so two OS users on the same machine are distinct peers with per-user ports. For SSH use ssh user@host, where user is the remote OS login (this selects the OS user on shared machines).

Step 3 — Add more devices

Repeat Step 2 for every additional machine. The process is always the same:

1. Install syncenv and initialize.
2. Exchange SSH keys with at least one existing peer.
3. Run syncenv sync to pull secrets.

Because discovery uses mDNS, the new machine will automatically find all peers on the local network. It only needs SSH access to one of them to fetch the secrets file.

# on each new machine
curl -fsSL https://syncenv.yuvrajthapa.com/install.sh | sudo bash
syncenv mode set trusted-owner-ssh --yes
syncenv init
ssh-copy-id user@any-existing-peer.local
syncenv sync

Optional — Enable AGE encryption

By default, secrets are stored in plaintext (SSH already encrypts the transport). For defense-in-depth you can enable per-value AGE encryption:

On every device

# initialize with encryption (generates an AGE key pair)
syncenv init --encrypted

Exchange public keys

Each device needs the AGE public keys of all other devices so secrets can be encrypted for everyone:

# on device A — get its public key
syncenv key show
# outputs: age1xxxxxxxxxx...

# on device B — import device A's key (peer IDs are user@host)
syncenv key import age1xxxxxxxxxx... alice@deviceA.local

# bare hostnames still work for single-user machines, but user@host is canonical

# repeat in both directions for every pair

Sync to re-encrypt

# trigger a sync to re-encrypt secrets for all known recipients
syncenv sync

After sync, secrets are encrypted to all registered public keys. New devices added later will trigger automatic re-encryption when they sync.

Automate sync

# install cron job (syncs every 30 minutes)
syncenv cron --install

# or with a custom interval
syncenv cron --install --interval 10

# auto-load secrets in your shell
# add to ~/.bashrc or ~/.zshrc:
eval "$(syncenv load 2>/dev/null)"

Remove a device from the network

When a machine leaves your fleet (sold, decommissioned, etc.), clean it up:

On the departing device

# stop the service and remove cron
syncenv service uninstall
syncenv cron --remove

# delete all local data
rm -rf ~/.config/syncenv

# remove the binary
sudo rm -f /usr/local/bin/syncenv

On remaining devices

# remove the departing machine's SSH key (optional)
ssh-keygen -R departed-host.local

If encryption is enabled, the departing device's public key will be automatically dropped from the recipient list on the next sync, since it no longer advertises itself via mDNS.

For extra security: rotate any secrets the departing device had access to.