From a80ab6138da7a457f2cce5fd77bc7c56eb020d0c Mon Sep 17 00:00:00 2001
From: Silvio Rhatto <rhatto@riseup.net>
Date: Sat, 24 Feb 2024 21:57:31 -0300
Subject: Feat: docs: secrets: tpc: on hashed passphrases

---
 docs/tpc.md | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/docs/tpc.md b/docs/tpc.md
index 96140a9..5266b83 100644
--- a/docs/tpc.md
+++ b/docs/tpc.md
@@ -66,14 +66,21 @@ If you already have the secret somewhere, you can use a construction like this
 which already adds the eyaml block into the hiera config file:
 
     keyringer $HYDA decrypt /path/to/some/secret | \
-      hydra $HYDRA eyaml $VOLNAME encrypt -q -o block --sdtin -l some::password >> \
+      hydra $HYDRA eyaml $VOLNAME encrypt -q -o block --stdin -l some::password >> \
       $CONFIG_FOLDER/puppet/config/secrets/node/$VOLNAME.$DOMAIN.yaml
 
 You can also ensure a fresh random passphrase is used, using your favourite
 generator like this:
 
     head -c ${1:-20} /dev/urandom | base64 | \
-      hydra $HYDRA eyaml $VOLNAME encrypt -q -o block --sdtin -l some::random:password >> \
+      hydra $HYDRA eyaml $VOLNAME encrypt -q -o block --stdin -l some::random:password >> \
+      $CONFIG_FOLDER/puppet/config/secrets/node/$VOLNAME.$DOMAIN.yaml
+
+For `passwd(5)` and `shadow(5)` hashed passphrases, use something like this:
+
+    head -c ${1:-20} /dev/urandom | base64 | \
+    mkpasswd -m sha-512 --stdin | \
+      hydra $HYDRA eyaml $VOLNAME encrypt -q -o block --stdin -l some::random:password >> \
       $CONFIG_FOLDER/puppet/config/secrets/node/$VOLNAME.$DOMAIN.yaml
 
 [hiera-yaml]: https://github.com/voxpupuli/hiera-eyaml
-- 
cgit v1.2.3