A Go implementation of @hugo-fixit/encrypt — a post-build AES-256-GCM encryption tool for the FixIt Hugo theme.

fixit-encrypt

A Go implementation of @hugo-fixit/encrypt — a post-build AES-256-GCM encryption tool for the FixIt Hugo theme.

It encrypts plaintext content inside <template data-password="..."> elements generated by FixIt content encryption templates.

Install

Download pre-built binaries from GitHub Releases, or install via Go:

1

go install github.com/hugo-fixit/fixit-encrypt@latest

Build from source:

1
2
3

git clone https://github.com/hugo-fixit/fixit-encrypt.git
cd fixit-encrypt
make build

Cross Compilation

Build binaries for all platforms (linux/darwin/windows x amd64/arm64):

1

make dist

Output binaries are placed in the dist/ directory.

Usage

After building your Hugo site, run the encryption tool from your site root:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

# Encrypt content in the default public/ directory
fixit-encrypt

# Encrypt content in a custom directory
fixit-encrypt --input dist

# Verify all templates are encrypted
fixit-encrypt --verify

# Dry run to see which files would be changed
fixit-encrypt --dry-run

Options

Hugo Integration

In your site’s package.json:

Or use it in a GitHub Actions workflow via the action-fixit-encrypt:

1
2
3
4
5
6
7
8

- name: Setup fixit-encrypt
  uses: hugo-fixit/action-fixit-encrypt@v1

- name: Build Hugo site
  run: hugo --gc --minify

- name: Encrypt content
  run: fixit-encrypt --input public

How It Works

1. Scans all .html files in the input directory
2. Finds <template data-password="..."> elements (encryption placeholders)
3. Encrypts the plaintext content using AES-256-GCM with PBKDF2 key derivation
4. Replaces the data-password hash with a PBKDF2-protected version
5. Writes the encrypted payload back to the template element

Security

• Algorithm: AES-256-GCM (authenticated encryption)
• Key derivation: PBKDF2 with 100,000 iterations and random 16-byte salt
• Password verification: PBKDF2-protected hash (not raw SHA-256)
• Payload format: base64(salt).base64(iv).base64(ciphertext+tag)

Comparison with the Node.js Version

This Go implementation produces identical output to the Node.js version and can be used as a drop-in replacement. Benefits of the Go version:

• Single binary — no Node.js runtime required
• Faster startup — no module loading overhead
• Easier deployment — copy one binary to CI/CD environments

License

MIT