DEV Community: Claus Guttesen

A Git-like tool to keep track of configuration files

Claus Guttesen — Thu, 15 May 2025 16:59:06 +0000

Kitty - A secure, encryption-focused configuration management tool written in Rust

I built Kitty to solve a problem I faced while managing configuration files across servers: I wanted Git-like tracking for system config files, but with built-in encryption and the ability to keep files in their original locations.

What is Kitty?

Secure configuration management tool with Git-like commands
Files remain in their original locations (no need to symlink like with dotfiles managers)
All stored content is encrypted with ChaCha20-Poly1305
Password-protected repository access
Choose between file-based or SQLite storage
Works with system files that might require elevated privileges

Core features:

Track, version, and restore configuration files
See differences between tracked and current versions
Filter and group tracked files
Restore previous versions when needed
Privilege handling for system files

Kitty is designed for sysadmins, DevOps engineers, and anyone who wants to securely track configuration files without moving them into a Git repository.

The project is open source and written in Rust. It focuses on security first, with all sensitive content encrypted, making it suitable for tracking credentials and other sensitive configurations.

GitHub repo: https://github.com/kometen/kitty

I'd love feedback from the HN community, especially on the security model and additional features that would be useful for your configuration management workflow.

Encrypt messages on device and share using a link

Claus Guttesen — Thu, 27 Mar 2025 16:51:51 +0000

I wrote a webapplication with great help from Claude AI, where you can create a message, have it encrypted, upload the encrypted message to a server, share a link and decrypt it using a key downloaded to your device.

Decrypting messages can be done without registering an account. Encrypting messages requires a registration. A profile is registered at Bitwarden, and a passkey is registered on your device. I can't read the profile at Bitwarden, apart from a random uuid.

Write a message (optional):

Encrypt in browser, store encrypted message on server, and download key (optional).

Decrypt message with key.

The code is available at https://github.com/kometen/rocket-ssr. An example can be opened at https://obscura.bsky.dk/message/gKSxqMBjzj1Su0QAViN6zg. Use the key sSjMGidFJzDuG6h2LNsxBHGr/dwgIoP+CWAOGgxRXZ8= to decrypt it.

Enjoy.

It is build using the Rust based Rocket framework, Bitwardens passwordless service. And the example is based on https://github.com/davidzr/passwordless-rust.

DNS-load-balancing

Claus Guttesen — Sat, 14 Dec 2024 17:54:44 +0000

If you sometimes need to use a DNS-server in kubernetes at work you can add this to your network-settings. But reconfiguring the settings can be tedious.

I wrote a DNS-forwarder that could talk to one or more public DNS-servers and the kubernetes DNS-server, and let it handle the rest. This way I always have a working DNS-resolution even if not all DNS-servers are reachable. The DNS-load-balancer can be found at https://github.com/kometen/dns-load-balancer/.

As an example here is my config.toml:

$ cat /usr/local/etc/dns-load-balancer/config.toml
[[servers]]
address = "1.1.1.1"
use_tls = true
description = "Cloudflare DNS"

[[servers]]
address = "8.8.8.8"
use_tls = true
description = "Google DNS"

[[servers]]
address = "10.152.183.10"
use_tls = false
description = "Kubernetes DNS"

When the Wireguard VPN-tunnel is not connected to the kubernetes-cluster:

$ host postgresql.invoice.svc.cluster.local
DNS resolution failed: Failed to resolve hostname: postgresql.invoice.svc.cluster.local.
Root cause: no record found for Query { name: Name("postgresql.invoice.svc.cluster.local."), query_type: AAAA, query_class: IN }
Error: Failed to resolve hostname: postgresql.invoice.svc.cluster.local.

Caused by:
    no record found for Query { name: Name("postgresql.invoice.svc.cluster.local."), query_type: AAAA, query_class: IN }

When connected:

$ host postgresql.invoice.svc.cluster.local
postgresql.invoice.svc.cluster.local has address 10.152.183.95

Had I configured the Kubernetes DNS as the only DNS-server, either in network-settings or in config.toml no nameresolution would take place. By adding Cloudflare and Google nameresolution will usually work and only fail if the Wireguard VPN is not connected and I query for services in Kubernetes.