Configuration

Configuration files

NokVault supports two levels of configuration:

• Global config: ~/.config/nokvault/config.toml - applies to all projects
• Local config: .nokvault.toml - applies to the current directory and overrides global settings

Local configuration takes precedence over global configuration, allowing project-specific settings.

Initializing configuration

Create a default configuration file:

# Initialize global configuration
nokvault config --init

# This creates ~/.config/nokvault/config.toml with default values

Viewing configuration

Inspect the merged settings:

# Show all configuration (global + local merged)
nokvault config --show

# Get a specific value
nokvault config --get memory_cost
nokvault config --get time_cost
nokvault config --get parallelism

Changing configuration

Edit ~/.config/nokvault/config.toml or a project-local .nokvault.toml directly, or run nokvault config --init to create a default global file. The supported keys are memory_cost, time_cost, and parallelism. The CLI intentionally has no config --set command.

Configuration file format

Configuration files use TOML. Example config.toml:

[key_derivation]
memory_cost = 65536  # KiB (64 MiB)
time_cost = 3
parallelism = 4

Environment variables

Password input can be supplied non-interactively via the environment. Argon2id settings are read only from configuration files:

# Password for non-interactive use
export NOKVAULT_PASSWORD="your-password"

Project-specific configuration

Create a .nokvault.toml file in your project directory for project-specific settings:

# .nokvault.toml
[key_derivation]
memory_cost = 131072  # stronger KDF for new encryptions in this project

Local settings override global ones. KDF overrides here affect only new encryptions under this project.

Key derivation

Key derivation settings apply when creating encrypted files only (encrypt, rotate-key re-encryption, watch, schedule). Decryption always uses the Argon2 parameters stored in each file's header (format v2) or built-in defaults for older v1 files - changing config does not affect existing ciphertext.

Older config files may contain previously generated encryption, security, or path keys. Those keys never affected runtime behavior; they are now ignored and are not written by config --init.