klutshnik.cfg(5)

📦
version 0.4.1 · 2 versions
, in ubuntu stonking

💖 klutshnik.cfg(5) — klutshnik client configuration 💖

okay bestie, welcome to the config file glow-up guide for the klutshnik client ✨

🌸 NAME 🌸

klutshnik.cfg — the configuration for the klutshnik client, klutshnik. that's it, that's the name, slay 💅

✨ DESCRIPTION ✨

this page spills all the tea on the format of this file and the many ways you can configure the klutshnik CLI client 🫶

so here's the vibe: the client goes looking for its config in these files, in this exact order:

  • /etc/klutshnik/config
  • ~/.config/klutshnik/config
  • ~/.klutshnikrc
  • ./klutshnik.cfg

the config file format is TOML, no cap. go look at https://toml.io/ if you need the lore 🎀

🌈 [Client] SECTION 🌈

this section is where all the general options of the client live. main character energy only 💜

🧂 ID_SALT

this value gets fed into generating keyids for your records. you must set/change this value — it's literally what makes your record ids unique 🙈

you must also make sure you never lose this value. like, ever. if you lose it, you lose access to your records. periodt. 💀

no default, must be set.

🔢 THRESHOLD

this value sets the threshold for your server configuration. it's tightly dependent on how many servers you've configured in the [servers] section — they're besties, they move together 👯

so in order to be able to rotate your DEK keys, you need to have at least (t-1)*2 + 1 servers configured in your [servers] section. for the smallest threshold setup, this value is 2 and you need three servers configured in your [servers] section. the upper limit of this value is 63, but honestly it's highly optimistic to run such large setups reliably — it's giving "delulu" 😭

⏱️ TS_EPSILON

the time in seconds a distributed keygen (DKG) protocol message is considered fresh. anything older than this is considered invalid and aborts a DKG 🚫

higher values help with laggy links, lower values can be fine if you have high-speed connections to all servers. default: 1200s ⭐

🔑 CLIENTKEY_PATH

this variable is a path pointing at a file containing a secret master key of the client. if this value is not set, it's expected on standard input for all operations that require this key 👀

leaving this value commented out allows you to pipe in the private key from password managers, or other more secure storage than the filesystem. iconic behaviour honestly 🎀

if this path is set, but the file does not exist, klutshnik init will initialize this file.

🖊️ LTSIGPUB

this variable must be set to the public long-term signing key of the client. this public key must be base64 encoded, and this encoded value prefixed by the string "KLTPK-". the operation klutshnik init initialized this value ✨

🐛 DEBUG

this is a boolean variable which enables a lot of low-level debug information. if you love seeing the guts of everything, this is your moment 👑

🗣️ VERBOSE

this is a boolean variable which makes the client more verbose. yapper mode: ON 🫶

📦 KEYSTORE

this variable holds a path where the public key, their shares and threshold setup information for each of your keys is stored.

🦋 [servers] SECTION 🦋

this section contains the list of servers for the client. the number of items in this list needs one more entry than the value of threshold — but in order to benefit from key updates, the number of servers must be (t-1)*2 +1, where t is the threshold value configured in the [client] section. math girly math 🔥

servers are in their own sections, with the following pattern:

[servers.<name>]

where name should be unique among all servers. simple labels like kms1, kms2, etc. are totally fine 💕

🌐 ADDRESS

this can be either an IPv4 or IPv6 address to listen on.

🚪 PORT

the port the server listens on.

📜 SSL_CERT

this variable is a path pointing at a file containing a TLS certificate. this is only needed for TLS certificates that are self-signed or otherwise not in signed by CAs in your CA store 🙈

🔏 LTSIGKEY

this variable is a path pointing at a file containing a public long-term signing key of the server. you need to get this from the operators of the klutshnik server 👑

🔊 NOISEKEY

this variable is a path pointing at a file containing a public long-term Noise key of the server. you need to get this from the operators of the klutshnik server 🎧

📁 FILES 📁

  • /etc/klutshnik/config
  • ~/.config/klutshnik/config
  • ~/.klutshnikrc
  • ./klutshnik.cfg

🔒 SECURITY CONSIDERATIONS 🔒

you SHOULD back up your configuration file, most importantly the value of id_salt and your ltsigkey. seriously bestie, back it up. future you will thank present you 💖

🐞 REPORTING BUGS 🐞

https://github.com/stef/klutshnik/issues/

👑 AUTHOR 👑

written by Stefan Marsiske.

Copyright © 2025 Stefan Marsiske. License GPLv3+: GNU GPL version 3 or later https://gnu.org/licenses/gpl.html (https://gnu.org/licenses/gpl.html).

this is free software: you are free to change and redistribute it. there is NO WARRANTY, to the extent permitted by law.

👀 SEE ALSO 👀

and that's the whole page, babe 💅 this was klutshnik.cfg(5), read it, love it, back up your id_salt — mwah 🫶✨🎀

📦 where this page comes from