indietool

The fast builder's toolkit — less managing, more making

Tired of bouncing between registrars, tracking domain renewals in spreadsheets, and copy-pasting secrets into .env files?

🎯 indietool is the fast builder's toolkit — less managing, more making. It helps you

• 🌍 Hunt domain names across 50+ TLDs — in seconds
• 🗓️ Track expiries across registrars like Cloudflare & Porkbun
• ☁️ Manage DNS records across providers with auto-detection
• 🔐 Securely store API keys & secrets — OS keyring or SSH-key encrypted

No dashboards. No vendor lock-in. Just you and your terminal.

Demo: domain explore -> domains list -> dns set -> secret get in under 30 seconds

# Homebrew (recommended)
brew install indietool/tap/indietool

# Go
go install github.com/indietool/cli@latest

# Binary releases (macOS, Linux, Windows)
# Download from https://github.com/indietool/cli/releases

# Shell completions
indietool completion bash > /usr/local/share/bash-completion/completions/indietool
indietool completion zsh > /usr/local/share/zsh/site-functions/_indietool
indietool completion fish > ~/.config/fish/completions/indietool.fish

# Check domain availability (no API keys needed!)
indietool domain explore myapp

# Save a test API key (auto-creates encryption key)
indietool secret set stripe-key "sk_test_..." --note "Stripe test key"

# Manage DNS records with automatic provider detection
indietool dns list example.com

# Check which domains are available
indietool domain explore myproject --tlds dev,com,ai

# Set up DNS records for your new domain
indietool dns set myproject.dev @ A 192.168.1.100
indietool dns set myproject.dev www CNAME myproject.dev
indietool dns set myproject.dev api A 192.168.1.101

# Store your API keys securely (auto-creates encryption key)
indietool secret set openai-key "sk-..." --note "OpenAI API key"
indietool secret set stripe-key "sk_test_..." --note "Stripe test key"

# Organize secrets by project using custom databases
indietool secret set api-key@myproject "key123" --note "Project-specific key"

# Check domain expiry before renewal
indietool domains list --provider cloudflare

# Verify DNS configuration before going live
indietool dns list myproject.com --wide

# Clean up old DNS records
indietool dns delete myproject.com old-api A

# Update production DNS records
indietool dns set myproject.com @ A 203.0.113.10
indietool dns set myproject.com www CNAME myproject.com

# Export secrets for deployment
export OPENAI_KEY=$(indietool secret get openai-key -S)

Problem: Manually checking domain names is slow and painful. Solution: indietool domain explore checks 50+ TLDs in seconds.

indietool domain explore awesomeproject

DOMAIN                     STATUS     TLD         EXPIRY
awesomeproject.ai          Available  ai          -
awesomeproject.dev         Available  dev         -
awesomeproject.com         Taken      com         2026-07-06
...
50 domains checked: 45 available, 5 taken

Filter by specific TLDs:

indietool domain explore awesomeproject --tlds ai,dev,io,sh

Or pass a TLD list from file:

indietool domain explore myproject --tlds @tldfile

Know the exact domain you're targeting?

indietool domain search awesomeproject.io

Problem: Domains expire. You don't want surprises. Solution: View all domains across registrars in one simple table.

First, connect your registrar(s):

# Cloudflare
indietool config add provider cloudflare \
  --account-id YOUR_ACCOUNT_ID \
  --api-token YOUR_TOKEN \
  --email your@email.com

# Porkbun
indietool config add provider porkbun \
  --api-key YOUR_KEY \
  --api-secret YOUR_SECRET

# The Little Host (DNS only)
indietool config add provider thelittlehost --api-key tlh_YOUR_API_KEY

Then list your domains:

indietool domains list

NAME                PROVIDER    STATUS   EXPIRES  AUTO-RENEW  AGE
myawesomeapp.com    cloudflare  healthy  8mo      Yes         2y
sideproject.ai      cloudflare  healthy  1y       Yes         1y

Need more info?

indietool domains list --wide

NAME                PROVIDER    STATUS   EXPIRES  AUTO-RENEW  AGE   NAMESERVERS                          COST  UPDATED
myawesomeapp.com    cloudflare  healthy  8mo      Yes         2y    fred.ns.cloudflare.com,pam.ns.cl...  N/A   2y
sideproject.ai      cloudflare  healthy  1y       Yes         1y    fred.ns.cloudflare.com,pam.ns.cl...  N/A   1y

Problem: Managing DNS records across different providers is tedious and error-prone. Solution: indietool dns automatically detects your DNS provider and lets you list and update records from the command line.

# Auto-detect provider and list records
indietool dns list example.com

DNS Provider: cloudflare
TYPE  NAME     CONTENT
A     @        192.168.1.1
A     www      192.168.1.2
CNAME api      example.com
MX    @        10 mail.example.com

Note: Cloudflare proxied records are indicated with a cloud icon, available only with the Cloudflare provider, for domains hosted on Cloudflare

indietool dns list example.com --wide

TYPE  NAME     CONTENT          TTL   PRIORITY  ID
A     @        192.168.1.1      300             abc123
A     www      192.168.1.2      300             def456
CNAME api      example.com      300             ghi789
MX    @        mail.example.com 300   10        jkl012

# Add an A record
indietool dns set example.com www A 192.168.1.100

# Add MX record with priority
indietool dns set example.com @ MX "10 mail.example.com" --priority 10

# Add TXT record for domain verification
indietool dns set example.com @ TXT "v=spf1 include:_spf.google.com ~all"

# Delete specific record by name and type
indietool dns delete example.com www A

# Delete all records for a name (with confirmation)
indietool dns delete example.com api

# Delete specific record by ID (when multiple records have same name)
indietool dns delete example.com test --id abc123

# Delete without confirmation
indietool dns delete example.com www A --force

# Delete root domain record
indietool dns delete example.com @ MX

# Combine filters for precision
indietool dns delete example.com api --type CNAME --id def456

# Use specific provider instead of auto-detection
indietool dns list example.com --provider cloudflare
indietool dns set example.com api A 192.168.1.50 --provider porkbun
indietool dns delete example.com old-record A --provider namecheap

• Cloudflare - Full CRUD operations with proxy status indicators
• Porkbun - Complete DNS record management (list, set, delete)
• Namecheap - Full CRUD support with batch operations
• The Little Host - Full DNS record management

indietool automatically detects your DNS provider by checking nameservers:

• No need to specify --provider in most cases
• Seamlessly works across different providers
• Falls back to manual provider selection if needed

Problem: Secrets are either insecure or annoying to manage. Solution: indietool secrets encrypts secrets using your OS keyring — no cloud, no sync, no complicated setup to manage.

indietool supports two backends for storing the database encryption key:

• keyring (default) — uses your OS keyring. Works well for desktop sessions.
• age-ssh (recommended for servers / SSH sessions) — encrypts the key with your SSH public key and stores it as a file. Decryption uses your SSH private key or agent.

# Explicit initialization with age-ssh (recommended for remote hosts)
indietool secrets init --backend age-ssh

# Specify a custom SSH key pair
indietool secrets init --backend age-ssh \
  --ssh-public-key ~/.ssh/id_rsa.pub \
  --ssh-private-key ~/.ssh/id_rsa

# Explicit initialization using the OS keyring
indietool secrets init --backend keyring

If indietool detects that the keyring is unavailable (e.g. in an SSH session), it will guide you through selecting an SSH key automatically on first use.

No setup required! The first time you store a secret, indietool automatically creates an encryption key.

indietool secret set stripe-key "sk_test_..." --note "Stripe test key"
Auto-generated encryption key for database 'default'
Secret 'stripe-key' stored successfully

Use the key@database format to organize secrets by project or environment:

# Store in custom databases
indietool secret set api-key@production "prod_key_123"
indietool secret set api-key@staging "staging_key_456"
indietool secret set db-password@myproject "secret123"

# Retrieve from specific database
indietool secret get api-key@production -S

# Safe output (masked)
indietool secret get stripe-key

# Show actual value (use -S or --show)
indietool secret get stripe-key -S

# List secrets in default database
indietool secret list

# List secrets in specific database
indietool secret list @production
indietool secret list @staging

List all your secret databases:

indietool secrets db list

Available secrets databases:
  default (default)
  production
  staging
  myproject

Delete a database and all its secrets:

# Interactive confirmation
indietool secrets db delete staging

# Force delete without confirmation
indietool secrets db delete staging --force

# Inject secret into command
indietool secret exec stripe-key -- curl -H "Authorization: Bearer *** https://api.stripe.com/v1/charges

# Use in environment variable
export STRIPE_KEY=$(indietool secret get stripe-key -S)

Where secrets live:

• Secrets are encrypted with AES-256-GCM at ~/.config/indietool/secrets/
• The encryption key is stored in your OS keyring (default) or as an age-encrypted file (~/.config/indietool/keys/)
• No cloud, no sync, no telemetry — everything stays on your machine

Threat model:

• indietool never phones home. Zero telemetry.
• Secrets are useless without your encryption key (OS keyring or SSH private key)
• If you lose your machine, secrets are unrecoverable (by design)
• For cross-host access, use age-ssh backend + SSH agent forwarding

Provider tokens:

• API keys for Cloudflare/Porkbun/etc. are stored in ~/.config/indietool/config.yaml
• File permissions are restricted to your user (chmod 600)
• Consider using environment variables or indietool secrets for sensitive tokens in shared environments

Legend:

• ✅ Full support
• 🚧 In development (GoDaddy DNS coming soon)
• ❌ Not supported

Notes:

• Domains: Domain registration management, expiry tracking, nameserver updates
• DNS: DNS record management (list, create, update, delete) with ID-based targeting
• Secrets: Local encrypted secret storage (OS keyring or age-ssh backend)

Encrypted locally at ~/.config/indietool/secrets/. The encryption key is stored in your OS keyring (default) or as an age-encrypted file at ~/.config/indietool/keys/ when using the age-ssh backend.

Secrets are useless without your encryption key. With the default keyring backend, start fresh on the new machine. With the age-ssh backend, your key file (~/.config/indietool/keys/) and SSH private key are both required — back up the keys directory if you need portability.

Experimental. Windows binaries are available in releases, but testing is limited. macOS and Linux are fully supported.

If you're on Windows and hit issues, please open an issue — we want to make it work!

• Ensure your keyring (Keychain or gnome-keyring) is unlocked
• Check file permissions on ~/.config/indietool/secrets/

GUI keyrings like GNOME Keyring require a graphical session to unlock, so they fail over SSH. Use the age-ssh backend instead:

indietool secrets init --backend age-ssh

This encrypts the database key with your SSH public key. To decrypt over SSH, connect with agent forwarding enabled:

ssh -A yourserver.example.com
# or add 'ForwardAgent yes' to your ~/.ssh/config

• Check file permissions on ~/.config/indietool
• Ensure your user has write access to the config directory

• Double check key/secret pair
• Some registrars require IP allowlisting or scopes

• 🧩 Registrar support: Cloudflare, Porkbun, Namecheap, GoDaddy
• ☁️ DNS management: GoDaddy implementation in progress
• 💻 CLI only — no web UI or GUI planned
• 🔄 Secrets not synced across machines (by design — use age-ssh for cross-host access via SSH agent forwarding)
• 🪟 Windows support is experimental

• 🌐 indietool.dev
• 📦 GitHub Releases
• 🐛 Report issues
• 💬 Discussions & roadmap