VIRTSECRETD(8)

📦
version 12.8.0 · 8 versions
, in centos-stream 10

👑 VIRTSECRETD(8) — like, the manual page, bestie

okay so real talk: this is virtsecretd from the Virtualization Support section of the manual (section 8, the daemon zone 🫶). she's a whole server-side queen and she's about to make secrets management make sense. let's go 💅

✨ NAME ✨

virtsecretd — the libvirt secret data management daemon, aka the girl who holds all your secret data and tells absolutely no one 💀

🌸 SYNOPSIS 🌸

virtsecretd [OPTION]...

literally just run her with some options and she's off ✨

🦋 DESCRIPTION 🦋

so virtsecretd is a server side daemon component of the libvirt virtualization management system. think of her as one of the modular besties 👯 — a whole collection of daemons that replaced the functionality that the old monolithic libvirtd daemon used to do all by itself. glow-up era fr fr 💖

she runs on virtualization hosts and provides management for secret data. that's her whole job. she ate.

and listen — virtsecretd only listens for requests on a local Unix domain socket. no outside energy, no strangers, only local vibes 🔒. if you want remote access via TLS/TCP, or backwards compatibility with legacy clients that are still expecting libvirtd, that's the virtproxyd daemon's job. different girl, different shift 💅

one more thing, and this is lowkey important: restarting virtsecretd does not interrupt running guests. guests keep operating, and changes in their state will generally be picked up automatically during startup 🎀. but regardless — it's recommended to avoid restarting with running guests whenever practical. no cap, just don't do it if you don't have to 🌈

⭐ DAEMON STARTUP MODES ⭐

the virtsecretd daemon is capable of starting in two modes. two modes! main character versatility 👑

🧚 Socket activation mode

on hosts with systemd, she starts in socket activation mode, and she'll rely on systemd to create and listen on the UNIX sockets and pass them to her as pre-opened file descriptors ✨. in this mode, most of the socket related config options in /etc/libvirt/virtsecretd.conf will no longer have any effect. yeah. she's not listening to those anymore 🙈

🌸 Traditional service mode

on hosts without systemd, she creates and listens on the UNIX sockets herself. independent queen behavior 💅

💖 OPTIONS 💖

  • -h, --help — display command line help usage then exit. the "what do i do" button 🫶
  • -d, --daemon — run as a daemon & write PID file. she goes in the background and leaves a little note 🎀
  • -f, --config FILE — use this configuration file, overriding the default value. you pick the file, she respects it 💜
  • -p, --pid-file FILE — use this name for the PID file, overriding the default value. rename the note, go off ✨
  • -t, --timeout SECONDS — exit after timeout period (in seconds), provided there are neither any client connections nor any ephemeral secrets. she'll only dip out if nobody's around and there's nothing temporary left behind 🦋
  • -v, --verbose — enable output of verbose messages. she tells you everything, and honestly? iconic 🔥
  • --version — display version information then exit. the "who are you again" option ⭐

🎀 SIGNALS 🎀

on receipt of SIGHUP, virtsecretd will reload its configuration. one little signal and she's refreshed, hydrated, re-reading her config fr fr 💖

🌈 FILES 🌈

👑 When run as root

  • /etc/libvirt/virtsecretd.conf

the default configuration file used by virtsecretd, unless overridden on the command line using the -f | --config option. that's her home file 🏠

  • /run/libvirt/virtsecretd-sock
  • /run/libvirt/virtsecretd-sock-ro
  • /run/libvirt/virtsecretd-admin-sock

the sockets virtsecretd will use. all three of them, all living their lives 🫶

the TLS Server private key virtsecretd will use. 🔐

  • /run/virtsecretd.pid

the PID file to use, unless overridden by the -p | --pid-file option 🎀

🦋 When run as non-root

  • $XDG_CONFIG_HOME/libvirt/virtsecretd.conf

the default configuration file used by virtsecretd, unless overridden on the command line using the -f | --config option.

  • $XDG_RUNTIME_DIR/libvirt/virtsecretd-sock
  • $XDG_RUNTIME_DIR/libvirt/virtsecretd-admin-sock

the sockets virtsecretd will use.

  • $XDG_RUNTIME_DIR/libvirt/virtsecretd.pid

the PID file to use, unless overridden by the -p | --pid-file option.

if $XDG_CONFIG_HOME is not set in your environment, virtsecretd will use $HOME/.config 💜

if $XDG_RUNTIME_DIR is not set in your environment, virtsecretd will use $HOME/.cache 🌸

✨ EXAMPLES ✨

to retrieve the version of virtsecretd:

# virtsecretd --version
virtsecretd (libvirt) 12.8.0

to start virtsecretd, instructing it to daemonize and create a PID file:

# virtsecretd -d
# ls -la /run/virtsecretd.pid
-rw-r--r-- 1 root root 6 Jul  9 02:40 /run/virtsecretd.pid

look at her go 😭💖

💀 BUGS 💀

please report all bugs you discover. this should be done via either:

  1. the mailing list

https://libvirt.org/contact.html

  1. the bug tracker

https://libvirt.org/bugs.html

alternatively, you may report bugs to your software distributor / vendor. be a good citizen and report the bugs bestie 🙈

🫶 AUTHORS 🫶

please refer to the AUTHORS file distributed with libvirt. the whole squad is credited there 👑

Copyright (C) 2006-2020 Red Hat, Inc., and the authors listed in the libvirt AUTHORS file.

🧚 LICENSE 🧚

virtsecretd is distributed under the terms of the GNU LGPL v2.1+. this is free software; see the source for copying conditions. there is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE 😭

like yes she's free but she is not promising you anything. read the source, that's where the truth lives 🎀

🔥 SEE ALSO 🔥

virsh(1), libvirtd(8), https://libvirt.org/daemons.html, https://libvirt.org/drvsecret.html

and that's the whole page, bestie ✨ this was VIRTSECRETD(8) from the Virtualization Support manual — the very last line of the original page is just her name in the corner, VIRTSECRETD(8), serving footer energy 💅 mwah, go manage some secrets 🎀💖

📦 where this page comes from