fnox 1.25.1

A flexible secret management tool supporting multiple providers and encryption methods
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98

# Quick Start

Get started with fnox in 5 minutes.

## 1. Initialize fnox

```bash
cd your-project
fnox init
```

This creates a `fnox.toml` configuration file.

## 2. Set a Secret

```bash
# Set a secret (prompts for value)
fnox set DATABASE_URL

# Or provide the value directly
fnox set DATABASE_URL "postgresql://localhost/mydb"
```

By default, secrets are stored as plain text defaults. For encryption, see the next section.

## 3. Get a Secret

```bash
fnox get DATABASE_URL
```

## 4. Run Commands with Secrets

```bash
# Secrets are loaded as environment variables
fnox exec -- npm start
fnox exec -- python app.py
fnox exec -- ./my-script.sh
```

## 5. Enable Shell Integration (Optional)

Automatically load secrets when you `cd` into a directory:

```bash
# Enable for your shell
eval "$(fnox activate bash)"  # or zsh, fish

# Add to your shell profile for persistence
echo 'eval "$(fnox activate bash)"' >> ~/.bashrc
```

To enable integration in other shells (Nushell, Powershell), see the [Shell Integration](/guide/shell-integration) guide.

Now secrets auto-load:

```bash
~/projects $ cd my-app
fnox: +3 DATABASE_URL, API_KEY, JWT_SECRET
~/projects/my-app $
```

## Add Encryption (Recommended)

For production use, encrypt your secrets:

### Using age encryption

```bash
# 1. Generate an age key
age-keygen -o ~/.config/fnox/age.txt

# 2. Get your public key
grep "public key:" ~/.config/fnox/age.txt
# Output: age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p

# 3. Configure the age provider in fnox.toml
cat >> fnox.toml << 'EOF'
[providers.age]
type = "age"
recipients = ["age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p"]
EOF

# 4. Set your decryption key
export FNOX_AGE_KEY=$(cat ~/.config/fnox/age.txt | grep "AGE-SECRET-KEY")

# 5. Encrypt a secret
fnox set DATABASE_URL "postgresql://prod.example.com/db" --provider age
```

The secret is now encrypted in `fnox.toml` and safe to commit to git!

## Next Steps

- [How It Works](/guide/how-it-works) - Understand fnox's architecture
- [Providers](/providers/overview) - Explore all available providers
- [Shell Integration](/guide/shell-integration) - Deep dive into shell integration
- [Real-World Example](/guide/real-world-example) - See a complete setup with multiple environments