At work I use org-mode to keep notes about useful ways to query our systems,mostly that involves using the built-in SQL support to access DBs and ob-http tosend HTTP requests. In both cases I often need to provide credentials for thesystems. I'm embarrassed to admit it, but for a long time I've taken the easypath and kept all credentials in clear text. Every time I've used one of thosecode blocks I've thought I really ought to find a better way of handling thesesecrets one of these days. Yesterday was that day.

I ended up with two functions that uses auth-source and its ~/.authinfo.gpgfile.

(defun mes/auth-get-pwd (host) "Get the password for a host (authinfo.gpg)" (-> (auth-source-search :host host) car (plist-get :secret) funcall))(defun mes/auth-get-key (host key) "Get a key's value for a host (authinfo.gpg)Not usable for getting the password (:secret), use 'mes/auth-get-pwd'for that." (-> (auth-source-search :host host) car (plist-get key))) It turns out that the library can handle more keys than the documentationsuggests so for DB entries I'm using a machine (:host) that's a bit shorterand easier to remember than the full AWS hostname. Then I keep the DB host andname in dbhost (:dbhost) and dbname (:dbname) respectively. That makesan entry look like this:

machine db.svc login user port port password pwd dbname dbname dbhost dbhost If I use it in a property drawer it looks like this

:PROPERTIES::header-args:sql: :engine postgresql:header-args:sql+: :dbhost (mes/auth-get-key "db.svc" :dbhost):header-args:sql+: :dbport (string-to-number (mes/auth-get-key "db.svc" :port)):header-args:sql+: :dbuser (mes/auth-get-key "db.svc" :user):header-args:sql+: :dbpassword (mes/auth-get-pwd "db.svc"):header-args:sql+: :database (mes/auth-get-key "db.svc" :dbname):END: Tags: emacs org-mode