Your own password store #2

// Give it a home

In part one we made a GPG key and created a password store, but so far it lives on a single machine. Today we’ll give it a home on a server, so that your phone can reach it and you have a copy if that machine dies. If you don’t have a computer at all, this is also where you’ll find the phone only route.

// Pick a home for your store

You need a git server to sync through. Since your store is encrypted you have more freedom here than you’d think, these are all good options:

A store is tiny, a few KB per password, so storage limits aren’t a concern anywhere. What you’re really choosing is who you’re comfortable with holding your file names and your history. With a hosted service you’re trusting a company or an association, with your own server you’re trusting yourself.

If you don’t know what to pick: GitHub or GitLab are the easiest to start with, Codeberg is the one I’d pick if you already contribute to free software, and your own server is what I use myself, once you’re comfortable with the rest.

Whichever you pick, you’ll need two things: an SSH key, which is how your computer proves who it is without a password, and an empty, private repository. Let’s make the key first, it’s the same for all of them:

1

ssh-keygen -t ed25519

Press Enter to accept the file name, and give it a passphrase if you want one. Then print the public part, which is the one you’ll paste on the provider’s website:

1

cat ~/.ssh/id_ed25519.pub

As with GPG, the public half isn’t a secret. The file without .pub is, and it never leaves your computer.

// GitHub

1. Create an account, then go to Settings, SSH and GPG keys, New SSH key, and paste your key.
2. Go to github.com/new, name the repository password-store and choose Private. Don’t add a README, a license or a .gitignore: the repository must be empty.
3. Your address is git@github.com:you/password-store.git.

// GitLab

1. Create an account, then in your profile’s preferences open SSH Keys and add your key.
2. Go to New project, choose Create blank project, name it password-store, set the visibility to Private and untick the option that creates a README.
3. Your address is git@gitlab.com:you/password-store.git.

// Codeberg

Codeberg is a non-profit for free software, and it’s upfront about it: private repositories are meant for people who contribute to free software, with a limit of 100 MB, and its terms allow “really small & personal stuff”, but not a personal cloud. A password store is small and personal, but if you don’t contribute to free software at all, please pick another provider and leave those resources to the people they’re meant for.

1. Create an account, then go to Settings, SSH / GPG keys, and add your key.
2. Go to New repository, name it password-store, tick Make repository private and leave everything else unticked so it stays empty.
3. Your address is git@codeberg.org:you/password-store.git.

// SourceHut

I’ve never used SourceHut for my store, so this comes from their documentation. It’s a small, independent and very no-nonsense service. Git hosting doesn’t require a paid account while the service is in alpha, but paying is how it stays alive.

1. Register at meta.sr.ht and add your key at meta.sr.ht/keys.
2. You don’t even need to create the repository: it’s created on your first push, and it’s private by default.
3. Your address is git@git.sr.ht:~you/password-store.

// Your own server

Any machine you can reach with SSH will do: a VPS, a NAS, a Raspberry Pi in the closet. All you need there is git and an empty repository:

1

git init --bare ~/password-store.git

Your address is you@server.example.org:password-store.git, and if SSH doesn’t run on port 22, use the long form: ssh://you@server.example.org:2222/home/you/password-store.git.

If you want a web interface as well, Forgejo is a lightweight self-hosted GitHub alternative, and it’s what powers Codeberg. Once it’s installed the steps are the same as Codeberg’s. Just remember that a server you own only stays safe if you keep it updated.

// Send your store to the server

Use your own address here:

1
2

pass git remote add origin git@github.com:you/password-store.git
pass git push -u origin HEAD

The first time SSH shows you the server’s fingerprint and asks if you trust it. Type yes. To be thorough, compare it with the one on the provider’s documentation first.

That’s it, your store now lives on the server too. If you open the repository in your browser you’ll see example.org.gpg, and if you open it you’ll see nothing useful. Good.

// The phone only route

No computer? Your phone can do everything we did above, thanks to Termux. Install it from F-Droid or from its GitHub releases, not from the Play Store, and open it. I’ll only tell you what’s different, the explanations above are still valid.

First update everything, this is not optional. If you skip it, GPG refuses to start with libgcrypt is too old. During the upgrade you may be asked what to do with some configuration files: just press Enter to keep the default.

1
2

pkg upgrade
pkg install gnupg pass git openssh

Let Termux reach your Download folder, and tap Allow when Android asks:

1

termux-setup-storage

Now it’s the same as in part one: tell git who you are, create your key and your store, make an SSH key, and send it all to the server. A couple of notes:

• GPG asks for the passphrase in a text box inside the terminal. Type it, move to the Repeat field with the Tab key (it’s on the extra row above the keyboard), type it again, press Tab to reach OK and then Enter.
• To copy your public SSH key on the provider’s website, run cat ~/.ssh/id_ed25519.pub, long-press the text in Termux and select it.

Then export your key where the app can find it:

1

gpg --armor --export-secret-keys you@example.org > ~/storage/downloads/private-key.asc

// Up next

You made it, now your store is safe on a server, and that was the boring part. In part three we’ll install HardenedPass, connect it to your store and see how to use it every day.

cheers 👋