secure-env

An environment variables Manager CLI tool, that encrypts your environment variables. When you need a set of env variables in the current shell call

eval $(secure-env --set <setname>)

to only inject a set of variables

or

eval $(secure-env)

to inject all of them.

The tool then prompts you for your password, with which the env variables have been encrypted, decrypts them into memory and prints export lines for the current shell. The program then closes itself and with it the env secrets in memory. The secrets live in your shell until the shell dies.

Quickstart

Note: Currently Rust (cargo) is needed to install the tool

1. Install the tool

cargo install secure-env

2. Set your environment

Now set your environment variables, that are going to be encrypted into a secure-env.enc file.

# For example a db set and and and app set:
secure-env --setenv db.HOST=localhost db.PORT=5432 app.API_KEY=secret-value

It will then prompt you for a password, that will be used to create an encrypted file with your environment variables in it. Running it again with new values merges them into the existing file.

To discard the existing file and start fresh (e.g. to re-encrypt everything with a new password), pass --force:

secure-env --force --setenv db.HOST=localhost db.PORT=5432

Editing with the interactive UI

To view and edit your variables in an interactive terminal UI, pass --open. You will be asked for your password, after which a simple editor opens showing every set.key = value:

secure-env --open

• ↑/↓ (or j/k) move the selection
• a add a new variable, e edit the selected value, d delete (with confirm)
• s save & quit (re-encrypts the file), q quit without saving

By default the encrypted file is stored at ~/.config/secure-env/secure-env.enc. Use --file <path> to store it somewhere else.

Note: If you lose this password, you are not able to decrypt the set environment variables anymore!