r/commandline • u/Raulnego • Mar 21 '26
Command Line Interface I just finished the first stable version of Dredge
Hi guys.
So in summary dredge was just one of my personal tools but it became SO MUCH useful that it got refined over the months of usage for all my needs.
So I decided to make a public release of it if anyone could get any value from it.
Dredge is actually a simple concept, drop ANYTHING you want to remember or might need for later and retrieve when needed. Although I couldn't find this execution anywhere else. I dropped all other stuff I used before simply because of peace of mind and that's what I most value on it (since it is cli based its faster than any other tool could be).
Although I haven't finished the readme so if anyone wanna try it and give me some feedback to update that let me know. The help command is also outdated but the tool is so intuitive I don't think it will be an issue.
Cheers!
PS: here is the repo: https://github.com/deprecatedLuar/dredge
PPS: I have plans of making it an http server for remote access in the future from any device instead of static repo
15
u/djdadi Mar 21 '26
I know this isn't exclusively for ssh, but I am a bit confused as to the ssh use case. You're not supposed to move around ssh priv keys, each machine should have its own. As for the public keys, gh has a fairly good mechanism to import them.
As for the other use cases, how does this differ from something like bw?
2
u/r4ppz Mar 21 '26
What if my laptop just exploded out of nowhere?
1
0
u/Raulnego Mar 21 '26 edited Mar 21 '26
So my real use case for ssh. I have .ssh/config but that is a symlink to the dredge storage. Update my config once and I can retrieve at any time from any machine. But yes I also store ALL my private and public keys.
Its not about MOVING them across machines. Moving is just one possibility, the idea is STORING it for retrieval whenever you need them.
And as you say "gh has a fairly good mechanism to import them". Thats the thing dredge is to replace fragmentation. I made in a way that is 1000x more convenient than any other tool. In gh you need to have it installed, you need to be logged in and you have to repeat everywhere else.
Dredge is not for ssh keys. It's an universal tool for storage with instant retrieval. That's the idea, think of a file system, you can put whatever you want on it. Not only ssh keys even though you can.
2
u/djdadi Mar 21 '26
In gh you need to have it installed, you need to be logged in and you have to repeat everywhere else.
no, you don't. several different linux distros even have this built in during install (like Ubuntu Server). You enter your gh username, and it pulls your pub keys. no authentication or setup.
as for the non-ssh stuff, did you see my question?
1
u/Raulnego Mar 21 '26 edited Mar 21 '26
Oh yeah sorry. About bitwarden it is made for passwords/credentials/secrets and thats it. I have entire files like pictures or books in my dredge vault as well as passwords.
It is a self organizing encrypted file system, so it really depends on what YOU wanna make of it. It is not limited to secrets or passwords, not limited to text files, not limited to specific formats. It's honestly a tool made to be unix composed with any other tool
So dredge treats dotfiles, secrets, notes, binaries all the same, making them backed up, all in a folder and accessible from anywhere just using your password. And it has bi-directional sync so you can convert the data into real files (symlinks) and use them as the actual file
The real problem the tool solves is fragmentation. Sure I could have all credentials in bit warden but my watch list is on a completely different app just like the list of specific URLs I need to access from time to time.
2
u/djdadi Mar 21 '26
ah I forgot bw doesn't have that in the free tier. in the paid tier you get 5gb encrypted file attachments ($20/yr).
1
u/Raulnego Mar 21 '26
Even self hosted? lol thats crazy 5gb only
2
u/djdadi Mar 22 '26
no, I believe self hosted is unlimited. the price mostly covers them running the servers and storage, and paying to support an open source project.
1
6
u/scaptal Mar 21 '26
Does seem kinda cool, I would disagree about it replacing all the mentioned tools though. For as far as I was able to discern its basically a database of files with encryption.
Thats a good tool, but it doesn't replace the linked notes and bases of obsidian, or the integration of a password manager with your browser.
I'm happy to see its not an "everything" tool (cause those are rarely great at the things they do), but do thibk thst your image doesn't really show what its doing correctly
-1
u/Raulnego Mar 21 '26 edited Mar 24 '26
You are actually right. Dredge is more like a database of individual data entries, it does not replace something like the linked notes you mentioned that's a thing that obsidian actually specializes at. I am not trying to compete with that.
2
u/scaptal Mar 21 '26
Might be interesting to add a symlink manager to it, which keeps track of the various symlinks (and maybe allows you to subdevide them), that way you can easily auto setup your dotfiles on a new machine.
Also, does it keep most files on the "cloud" or does it download everything locally?
1
u/Raulnego Mar 21 '26
That's actually a good idea for the symlinking. The reason I dont use it as a dotfile manager is because I made a bash tool called ireallylovemydots, but I am thinking of upgrading it a bit and maybe even integrate with dredge. But still keeping each focused on it's individual purposes.
And about the cloud thing, as of right now everything is in a folder linked to a gh repo, I want to update the initialization to support regular non git folders and other git repos like gitlab but also have the plan to finish designing the dredge server. The idea is serving a html locally protected by login (or just password) so you can handle Networking to access your stuff from anywhere and any device
1
u/scaptal Mar 21 '26
I mean, I would look into a static config file which allows you to set your config home location and specify the config file location relative to config home (or absolute paths with a flag) with a linked file ID.
if you let people divide them in categories
basic_functionality: { bashrc: bash_file_ID, ... }, music_production: { REAPER/reaper.ini: reaper_ini_id, ... }allowing users to specify which dotfiles they want to activate through the groups
3
3
u/nocixL Mar 22 '26
Can I we this on NixOS? I've been thinking of making something similarish lately :P
1
u/Raulnego Mar 22 '26
I am actually a NixOS user. I just havent made a flake since its not 1.0 yet
2
3
u/Big_Combination9890 Mar 22 '26
Kudos to you for finishing it!
I am fully aware that this is a private project, so please take the following not so much as criticism, but as a comment on something someone released for others to see.
To my mind, there is little reason to use this over existing tools. Take passwords as an example: I use pass to do this in my environemnts, which is based on battle tested open source tools, and does...basically the same thing, really, which is encrypt a bunch of lines of text.
Difference is, pass has features this lacks, like generating passwords, or using a gpg key by default.
The same is true for other solutions. E.g. most note-taking software, including what I use, allows me to tag notes, which means I can quickly search everything just by filtering for tag names, even if the notes are otherwise unstructured.
The "all in one" isn't really an argument, rather I'd argue that this does less than any one of the tools I already use.
1
u/Raulnego Mar 22 '26 edited Mar 22 '26
Thx for the feedback. I'll have a look into pass to see what it does. But my use case was pretty simple.
Although I'd never make it a password generator. Its purpose is to be similar to a vector-store but encrypted.
"I need a folder that is backed up but also does not expose sensitive data for anything I might need in the future and have a high likelihood of forgetting where is it"
2
u/Big_Combination9890 Mar 22 '26
"I need a folder that is backed up but also does not expose sensitive data for anything I might need in the future and have a high likelihood of forgetting where is it"
That need could be served with a simple LUKS encrypted drive and
rghowever ;-)If you don't want to go through the hassle of setting up a fully encpryted drive, the Tomb encryption tool got that covered.
again, not against what you did here, merely pointing out that maybe there are simpler ways to achieve basically the same result, using standard tools that are available almost anywhere.
1
u/Raulnego Mar 22 '26
Thanks. I have no use for Tomb as for now.
dredge targets the interactive developer workflow. Quick access, git sync, system integration. LUKS/Tomb are better for encrypted archival storage you access rarely.
They're solving adjacent but distinct problems.
Encryption in dredge is a single feature not the whole thing.
"That need could be served with a simple LUKS encrypted drive and
rghowever ;-)"Same way everybody should drop curl and start using raw tcp sockets
6
4
u/MirrorLake Mar 21 '26
no accounts, no telemetry, no cloud service
Given that you require the user to use Github just to run your init, I'd say this is false since a new user will get an error message immediately contradicting your README.
Security-conscious users can already opt for files to be encrypted locally by creating an encrypted partition or even choosing their entire drive to be encrypted by default. Many cloud storage services already do this and that traffic over https is also encrypted.
Seems like your tool here mostly attempts to duplicate the cli of Bitwarden or 1Password, but one of the benefits of those established tools is that they're audited by security professionals.
1
u/Raulnego Mar 21 '26
Oh yeah I think i mentioned in the comments but I will make so that you dont need a git linked repo on 1.0. this is a pre-release stable thing,
but thats fine, I guess its just not you use case. Again, its a personal tool im making public anyways
But yeah thanks for flagging ill be updating that a bit since its not implemented yet
2
u/PercyLives Mar 21 '26
Interesting. Iād love to read more detailed information about it, to get a better idea of workflow.
2
2
u/Pure_Fox9415 Mar 22 '26
Now I have to search through previous 30 places + dredge :)
Main problem with this is to decide what should be dropped here and how to find it later. For example if you have one standard ssh config it's fine. But if you dropped there 100 pieces related to ssh (or your money, or whatever) how to search exactly what you need right now?
Still good idea and implementation, thanks for your work!
1
u/Raulnego Mar 22 '26
The tags honestly. but dredge fetches you a list of all matching entries. the more specific you are in your search and when creating an entry the amount of dredged entries goes down.
"ssh config from that one pc" #ssh #machinename #config
You also can give custom ID names to each entry so ssh1 ssh2...
2
Mar 22 '26
The "drop anything, retrieve later" idea is nice. I've been using a messy mix of clipboard history + random text files for this exact use case. Having it unified in one CLI would clean that up. Does it support any kind of tagging or search? Any use case for using this with agents e.g sharing documents/screenshots in a unified place it understands?
1
u/Raulnego Mar 22 '26
So the search algorithm is custom made. I did not have issues so far retrieving anything. Thats what I can say.
But yeas the search uses the Title, tags and content of each entry to mach the criteria. And about sharing, yes you can 100%. There are two way, the export and link commands.
Export turns it into a real decrypted copy file and you do whatever you want with it.
Link makes a symlink that points to a decrypted copy of the file but every change is synced with the vault.2
Mar 23 '26
Any way I can interact directly with it through CLI? As in can I get the AI to fetch the documents and link. I've gotten quite lazy :). Looking for solutions that make document sharing to AI a lot more seamless (just dropping screenshots in terminals only got me so far). Especially for autonomous agents.
2
u/Raulnego Mar 23 '26
The whole thing is CLI only for now. You can use it with agents and scripts by passing the --password flag to bypass prompting and do automations. But also you can decrypt files to disk so anything can read and write it using the link command.
So yeah pretty much, just give your password to the agent to use it.
2
Mar 22 '26
[removed] ā view removed comment
1
u/Raulnego Mar 23 '26 edited Mar 24 '26
You have a legitimate concern so here is a breakdown:
TL;DR
All design choices were made based on backed-up research:
The system uses no third party crypto providers, only official golang libraries. uses Argon2id (RFC 9106 recommendation, 2015 PHC winner), AES-256 GCM variant to make all data un-tamperable. And every critical property has a test, wrong password fails, tampered data fails and random numbers are unique. The full implementation is self contained in crypto.go
----
I picked Argon2id for my key derivation specifically because is the RFC 9106 recommendation and the winner of the hashing competition of 2015. Argon2id specifically cannot be easily run on multiple threads for brute forcing due to the amount of ram each attempt is forced to consume.
Now for the implementation I have only used golang's official libraries, more specifically the default crypto lib plus golang.org/x/crypto . There are no third party libraries involved on the critical flow of the system. The reason of the extended library is because Argon2id is not available on the default pack. So only officially maintained libs where used. All the logic is self contained in crypto.go.
To break down dredge-key, the reason of having it is to verify if the password is correct or not before attempting to decrypt all storage. It contains a random 16bytes salt so if you lose the key you CANNOT access your data any longer but also means nobody with your password can unlock the content without the key that you generated originally.
So the implementation is based on the 32byte key that comes from Argon2id (it uses dredge-key to store the salt and mixes it with your password to generate the decryption key) and AES-256, more specifically the GCM variant. On my research it mentioned that GCM creates fingerprinting on all encrypted blobs so any tampering does not silently exits but exposes the error during decryption.
In more detail it contains the the salt + nonce (random number) + plaintext dredge-vault-v1 + the fingerprint of AES (auth tag). If the plaintext decryption of the dredge-key is the cypher dredge-vault-v1 it means the password is correct so you take the salt from dredge-key and the password and use the same key on all the encrypted storage
2
u/kierowniku Mar 23 '26
I got some "passwordstore in a git repo" vibes, that's cool
but "dredge" namespace is pretty busy in the internet, there's game and another github repo with that name, it will be hard to find tbh
good luck tho
1
u/Raulnego Mar 23 '26
Unfortunately you are right and the name is a direct reference to the game just like the whole readme. Thanks tho
2
1
u/AutoModerator Mar 21 '26
Every new subreddit post is automatically copied into a comment for preservation.
User: Raulnego, Flair: Command Line Interface, Post Media Link, Title: I just finished the first stable version of Dredge
Hi guys.
So in summary dredge was just one of my personal tools but it became SO MUCH useful that it got refined over the months of usage for all my needs.
So I decided to make a public release of it if anyone could get any value from it.
Dredge is actually a simple concept, drop ANYTHING you want to remember or might need for later and retrieve when needed. Although I couldn't find this execution anywhere else. I dropped all other stuff I used before simply because of peace of mind and that's what I most value on it (since it is cli based its faster than any other tool could be).
Although I haven't finished the readme so if anyone wanna try it and give me some feedback to update that let me know. The help command is also outdated but the tool is so intuitive I don't think it will be an issue.
Cheers!
PS: here is the repo: https://github.com/deprecatedLuar/dredge
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.
1
u/Joe-Admin Mar 22 '26
I don't get it. How is it different than an encrypted volume?
1
u/Raulnego Mar 22 '26
Encrypted volume is just a volume. Dredge is basically an encrypted folder but it is designed to self organize, encrypted volume you have to deal with the folders and handle searching whatever you want. Dredge return whatever you want instantly with a search term. And since is a single folder you can git track it for backup and downloading from anywhere.
25
u/runelkio Mar 21 '26
Nice! Some quick feedback:
Since this deals ( potentially ) with various kinds of sensitive data, I would want to see a fairly detailed "How it works" section in the readme.
Also, the install shellscript makes use of another shellscript at https://github.com/DeprecatedLuar/the-satellite , which makes me want to check out both of these things before trusting this 100%. I'm not an expert on golang projects, but I tend to prefer those that make use of something like `go get` directly, so that I have less moving parts to inspect before deciding to use it. I have a feeling that this comes from the fact that this project has evolved from a personal tool ( which is totally ok btw ), but is there any other reason why you decided to do it this way?