envx-secure 0.1.0

A CLI for .env file management: diff, audit, and encrypt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87

# envx

A fast, opinionated CLI for `.env` file management — diff, audit, encrypt.

## Install

```bash
cargo install --path .
```

## Commands

### `envx diff <file-a> <file-b>`

Semantic diff between two env files. Highlights added, removed, and changed
keys. Values for sensitive keys (`SECRET`, `KEY`, `TOKEN`, `PASSWORD`, etc.)
are always redacted.

Exits `0` if files are identical, `1` if differences are found.

**local vs staging:**

![diff local vs staging](docs/examples/diff-local-vs-staging.svg)

**staging vs production:**

![diff staging vs production](docs/examples/diff-staging-vs-production.svg)

---

### `envx audit --schema <schema-file> <env-file>`

Validates an env file against a schema. The schema is a plain-text file with
one required key per line (`#` comments allowed).

- `✗ MISSING` — required key absent → error
- `⚠ EMPTY` — required key present but blank → error
- `⚠ EXTRA` — key present but not declared in schema → warning

Exits `0` if no errors (warnings are OK), `1` if any required keys are missing
or empty.

**Failing audit** (`.env.local` is missing `SENTRY_DSN`):

![audit local fail](docs/examples/audit-local-fail.svg)

**Passing audit** (`.env.staging` satisfies all required keys):

![audit staging pass](docs/examples/audit-staging-pass.svg)

---

### `envx encrypt <file>` / `envx decrypt <file>`

Encrypts an env file with a passphrase using [age](https://age-encryption.org).
Prompts twice on encrypt (confirmation), once on decrypt.

```bash
# Produces .env.staging.age — original is kept
envx encrypt examples/.env.staging

# Restores to examples/.env.staging
envx decrypt examples/.env.staging.age
```

The original file is never deleted automatically.

---

## Example files

| File | Purpose |
|---|---|
| `examples/.env.local` | Local development defaults |
| `examples/.env.staging` | Staging environment |
| `examples/.env.production` | Production environment |
| `docs/examples/.env.schema` | Schema used in audit examples |

---

## Development

```bash
cargo build
cargo clippy -- -D warnings
cargo fmt
```