1diff --git a/config.example.scfg b/config.example.scfg
  2index 9de249b5a5f90bf9c59566794da9333add87a06d..f29e3ca5b3bcbece29c00645bacbcab4ec608416 100644
  3--- a/config.example.scfg
  4+++ b/config.example.scfg
  5@@ -3,6 +3,8 @@ # listen-addr tcp://localhost:8080
  6 listen-addr unix://var/run/cerrado.sock
  7 
  8 root-readme /srv/git/README.md
  9+passphrase $2a$14$VnB/ZcB1DUDkMnosRA6Y7.dj8h5eroslDxTeXlLwfQX/x86mh6WAq
 10+aes-key 8XHptZxSWCGs1m7QzztX5zNQ7D9NiQevVX0DaUTNMbDpRwFzoJiB0U7K6O/kqIt01jJVgzBUfiR8ES46ZLLb4w==
 11 
 12 scan /srv/git/ {
 13     public true
 14diff --git a/pkg/config/config.go b/pkg/config/config.go
 15index fd198086bb679225c6cc743d9df9eb2c332d0c53..902ff0d991aeae4e7719555479ec574edd10ad57 100644
 16--- a/pkg/config/config.go
 17+++ b/pkg/config/config.go
 18@@ -33,6 +33,8 @@ 	configuration struct {
 19 		Scan         *scan
 20 		RootReadme   string
 21 		ListenAddr   string
 22+		Passphrase   string
 23+		AESKey       string
 24 		Repositories []*GitRepositoryConfiguration
 25 	}
 26 
 27@@ -52,6 +54,8 @@ 	// information.
 28 	ConfigurationRepository struct {
 29 		rootReadme   string
 30 		listenAddr   string
 31+		passphrase   string
 32+		aesKey       string
 33 		repositories []*GitRepositoryConfiguration
 34 	}
 35 )
 36@@ -71,6 +75,8 @@ 	repo := &ConfigurationRepository{
 37 		rootReadme:   config.RootReadme,
 38 		listenAddr:   config.ListenAddr,
 39 		repositories: config.Repositories,
 40+		passphrase:   config.Passphrase,
 41+		aesKey:       config.AESKey,
 42 	}
 43 
 44 	if config.Scan.Path != "" {
 45@@ -170,6 +176,16 @@ 	if err != nil {
 46 		return nil, err
 47 	}
 48 
 49+	err = setPassphrase(block, &config.Passphrase)
 50+	if err != nil {
 51+		return nil, err
 52+	}
 53+
 54+	err = setAESKey(block, &config.AESKey)
 55+	if err != nil {
 56+		return nil, err
 57+	}
 58+
 59 	err = setRepositories(block, &config.Repositories)
 60 	if err != nil {
 61 		return nil, err
 62@@ -261,6 +277,16 @@
 63 func setRootReadme(block scfg.Block, readme *string) error {
 64 	scanDir := block.Get("root-readme")
 65 	return setString(scanDir, readme)
 66+}
 67+
 68+func setPassphrase(block scfg.Block, listenAddr *string) error {
 69+	scanDir := block.Get("passphrase")
 70+	return setString(scanDir, listenAddr)
 71+}
 72+
 73+func setAESKey(block scfg.Block, listenAddr *string) error {
 74+	scanDir := block.Get("aes-key")
 75+	return setString(scanDir, listenAddr)
 76 }
 77 
 78 func setListenAddr(block scfg.Block, listenAddr *string) error {
 79diff --git a/pkg/config/config_test.go b/pkg/config/config_test.go
 80index 8c1d27ebe8586e356314e45e6a5742766928b443..0970cfa43f9e5b1bf6617d654e3abc6ae0e3257c 100644
 81--- a/pkg/config/config_test.go
 82+++ b/pkg/config/config_test.go
 83@@ -103,6 +103,8 @@ 		{
 84 			name: "complete",
 85 			config: `
 86 listen-addr unix://var/run/cerrado/cerrado.sock
 87+passphrase $2a$14$VnB/ZcB1DUDkMnosRA6Y7.dj8h5eroslDxTeXlLwfQX/x86mh6WAq
 88+aes-key 8XHptZxSWCGs1m7QzztX5zNQ7D9NiQevVX0DaUTNMbDpRwFzoJiB0U7K6O/kqIt01jJVgzBUfiR8ES46ZLLb4w==
 89 
 90 scan "/srv/git" {
 91 	public true
 92@@ -122,6 +124,8 @@ 					Public: true,
 93 					Path:   "/srv/git",
 94 				},
 95 				ListenAddr: "unix://var/run/cerrado/cerrado.sock",
 96+				Passphrase: "$2a$14$VnB/ZcB1DUDkMnosRA6Y7.dj8h5eroslDxTeXlLwfQX/x86mh6WAq",
 97+				AESKey:     "8XHptZxSWCGs1m7QzztX5zNQ7D9NiQevVX0DaUTNMbDpRwFzoJiB0U7K6O/kqIt01jJVgzBUfiR8ES46ZLLb4w==",
 98 				Repositories: []*GitRepositoryConfiguration{
 99 					{
100 						Name:        "linux.git",