diff --git a/cmd/sshpiperd/snap/README.md b/cmd/sshpiperd/snap/README.md
new file mode 100644
index 00000000..f5861777
--- /dev/null
+++ b/cmd/sshpiperd/snap/README.md
@@ -0,0 +1,54 @@
+# Snap for sshpiperd
+
+[![Get it from the Snap Store](https://snapcraft.io/static/images/badges/en/snap-store-white.svg)](https://snapcraft.io/sshpiperd)
+
+## Install
+
+```
+sudo snap install sshpiperd
+```
+
+## Config
+
+```
+sudo snap set sshpiperd <config>=<value>
+sudo snap restart sshpiperd
+```
+
+### sshpiperd 
+
+ * `sshpiperd.plugins` space separated list of plugins, allowed values: `workingdir`, `fixed`, `yaml` `failtoban`,
+ * `sshpiperd.address` listening address
+ * `sshpiperd.port` listening port
+ * `sshpiperd.server-key` server key files, support wildcard
+ * `sshpiperd.server-key-data` server key in base64 format, server-key, server-key-generate-mode will be ignored if set
+ * `sshpiperd.server-key-generate-mode` server key generate mode, one of: disable, notexist, always. generated key will be written to `server-key` if  * no`texist or always
+ * `sshpiperd.login-grace-time` sshpiperd forcely close the connection after this time if the pipe has not successfully established
+ * `sshpiperd.log-level` log level, one of: trace, debug, info, warn, error, fatal, panic
+ * `sshpiperd.typescript-log-dir` create typescript format screen recording and save into the directory see https://linux.die.net/man/1/script
+ * `sshpiperd.banner-text` display a banner before authentication, would be ignored if banner file was set
+ * `sshpiperd.banner-file` display a banner from file before authentication
+ * `sshpiperd.drop-hostkeys-message` filter out hostkeys-00@openssh.com which cause client side warnings
+
+### workingdir plugin
+
+ * `workingdir.root path` to root working directory
+ * `workingdir.allow-baduser-name` allow bad username
+ * `workingdir.no-check-perm` disable 0400 checking
+ * `workingdir.strict-hostkey` upstream host public key must be in known_hosts file, otherwise drop the connection
+ * `workingdir.no-password-auth` disable password authentication and only use public key authentication
+
+### yaml plugin
+
+ * `yaml.config` path to yaml config file
+ * `yaml.no-check-perm` disable 0400 checking
+
+### fixed plugin
+
+ * `fixed.target` target ssh endpoint address
+
+### failtoban plugin
+
+ * `failtoban.max-failures` max failures
+ * `failtoban.ban-duration` ban duration
+
diff --git a/cmd/sshpiperd/snap/configgen/main.go b/cmd/sshpiperd/snap/configgen/main.go
index 43fe9566..828747dd 100644
--- a/cmd/sshpiperd/snap/configgen/main.go
+++ b/cmd/sshpiperd/snap/configgen/main.go
@@ -58,13 +58,22 @@ func extractFlags(namespace, filePath string) {
 					return true
 				}
 
+				var flagName string
+				var flagDesc string
+
 				for _, v := range cl.Elts {
 					if kv, ok := v.(*ast.KeyValueExpr); ok {
-						if kv.Key.(*ast.Ident).Name == "Name" {
-							fmt.Println(namespace + "." + strings.Trim(kv.Value.(*ast.BasicLit).Value, " \""))
+
+						switch kv.Key.(*ast.Ident).Name {
+						case "Name":
+							flagName = strings.Trim(kv.Value.(*ast.BasicLit).Value, " \"")
+						case "Usage":
+							flagDesc = strings.Trim(kv.Value.(*ast.BasicLit).Value, " \"")
 						}
 					}
 				}
+
+				fmt.Printf("%v.%v %v\n", namespace, flagName, flagDesc)
 			}
 		}
 		return true
diff --git a/cmd/sshpiperd/snap/launcher/main.go b/cmd/sshpiperd/snap/launcher/main.go
index 2adf496b..40b06dd5 100644
--- a/cmd/sshpiperd/snap/launcher/main.go
+++ b/cmd/sshpiperd/snap/launcher/main.go
@@ -70,17 +70,22 @@ func loadFromSnapctl() map[string][][]string {
 			continue
 		}
 
-		v, err := get(line)
+		parts := strings.Split(line, " ")
+		if len(parts) == 0 {
+			continue
+		}
 
+		opt := parts[0]
+		v, err := get(opt)
 		if err != nil {
-			log.Fatal(err)
+			log.Printf("error getting %v: %v", line, err)
 		}
 
 		if v == "" {
 			continue
 		}
 
-		parts := strings.Split(line, ".")
+		parts = strings.Split(opt, ".")
 		ns := parts[0]
 		flag := parts[1]