sparkbox

Values are write-only: once saved they can be updated or deleted, never read back here. A secret reaches every machine that shares one of its tags — new shells see changes now; running processes keep their old environment until the machine reboots. Anything running inside a tagged machine can read these values.

A rule-set is a list of domains a machine may reach. Tag a machine with a rule-set's tag and, while it runs, its egress is restricted to those domains (plus its own gateway) — everything else is blocked at the host. Untagged machines are unaffected. Rules take effect within seconds; existing connections may linger briefly.