1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
|
+++
title = "Connect the app"
date = 2026-11-05T00:00:00Z
description = "How to connect HardenedPass to your store: clone the repository, set up an SSH key or password, import your OpenPGP private key."
weight = 40
draft = false
+++
You need the address of your repository and the file with your private key. If you
have neither, start with [Create a store]({{< relref "/hardenedpass/getting-started/create-store" >}}).
## Clone the store
Open the app and tap **Clone Remote Repo**.
{{< image src="welcome.png" alt="Welcome screen with the buttons Clone Remote Repo, Create Local Repo and Settings." class="max-w-sm mx-auto rounded-lg border border-border" />}}
Type the address of your repository in **Repository URL** and choose how to log in
under **Authentication Mode**.
{{< image src="repository.png" alt="Repository information screen with the URL filled in and SSH key selected as authentication mode." class="max-w-sm mx-auto rounded-lg border border-border" />}}
These address forms all work:
| Form | Example |
|---|---|
| SSH, short | `git@git.example.org:store.git` |
| SSH, with a port | `ssh://git@git.example.org:2222/srv/git/store.git` |
| HTTPS | `https://git.example.org/you/store.git` |
The app warns you about addresses that would not work well: a custom port without
`ssh://`, a port on an HTTPS address, which is not supported, and `git://`, which has
no encryption.
### With an SSH key
Tap **Manage** next to the SSH key line.
{{< image src="ssh-key.png" alt="SSH key screen with the buttons Import SSH key and Generate SSH key pair." class="max-w-sm mx-auto rounded-lg border border-border" />}}
- **Import SSH key** reads a private key you already have, from a file.
- **Generate SSH key pair** makes a new key on the phone. Ed25519 is the best choice
unless your server is old. **Protect with screen lock credential** makes the app
ask for your screen lock each time it uses the key.
After generating, the app shows the public key. Add it to your git server, in the
same place you would add a key for a computer. Then go back and tap **Clone**.
### With a password
Choose **Password** and tap **Clone**. The app asks for the password when it connects,
and **Remember password** stores it encrypted on the phone. Many hosting services want
an access token here rather than your account password.
### The server's identity
On the first SSH connection the app saves the server's host key without asking, and
checks it on every connection after that. If the key changes, syncing stops with an
error. If you know why it changed, tap **Clear saved host key** on the repository
screen. If you do not, stop and find out first: someone could be impersonating your
server.
## Import your private key
Once the clone is done, the app shows which key the store is encrypted for, under
**Store recipients**.
{{< image src="pgp-import.png" alt="Import PGP key screen listing the store's recipient key ID, with an Import PGP key button." class="max-w-sm mx-auto rounded-lg border border-border" />}}
Tap **Import PGP key** and pick your key file. The app shows the ID of the imported
key: check that it matches. You can tap **Later** to skip this, but no entry can be
opened until a matching key is imported.
The list of entries opens, and you are done.
{{< image src="store-list.png" alt="The store list, showing the folders otp and work and the entry example.org." class="max-w-sm mx-auto rounded-lg border border-border" />}}
Delete the key file from the phone's storage now, as
[Create a store]({{< relref "/hardenedpass/getting-started/create-store" >}}) explains.
The first time you open an entry, the app asks for the key's passphrase.
## A store without a server
**Create Local Repo** makes a store that lives only on the phone. Import your private
key, then tap it in the list to create the store for that key. You still need a key
made elsewhere, on a computer or in Termux, and without a remote nothing protects you if
the phone is lost.
If you plan to sync, clone instead: a store made this way can push to a server added
later, but pulling from it currently fails.
|
