secrets

README

secrets

Manage secrets in configuration files.

Installation

curl -sf https://gobinaries.com/karimsa/secrets/cmd/secrets | sh

Features

• Encrypt/decrypt selective values
• Supports yaml, json, and .env files
• Editor mode to selectively re-encrypt secrets (better git diffs)

Usage

Encrypting secrets in a .env file

$ cat .env
HELLO=SECURE-WORLD
HI=INSECURE-WORLD
$ secrets encrypt --in .env --out .env --key .HELLO
Passphrase: ******
$ cat .env
HELLO=64745a1f754b45bb60c40e14c04ead39afb0d774e9f25f90459de9f714da3ed19c94063e79649d38b0ebb5cc3eaf06554476cbf7bc65ef0cd472c28370bcdb57105343180700523771733f8cfe2e7222
HI=INSECURE-WORLD

Reveal secrets from .env file

$ cat .env
HELLO=64745a1f754b45bb60c40e14c04ead39afb0d774e9f25f90459de9f714da3ed19c94063e79649d38b0ebb5cc3eaf06554476cbf7bc65ef0cd472c28370bcdb57105343180700523771733f8cfe2e7222
HI=INSECURE-WORLD
$ secrets decrypt --in .env --key .HELLO
Passphrase: ******
HELLO=SECURE-WORLD
HI=INSECURE-WORLD
$ cat .env
HELLO=64745a1f754b45bb60c40e14c04ead39afb0d774e9f25f90459de9f714da3ed19c94063e79649d38b0ebb5cc3eaf06554476cbf7bc65ef0cd472c28370bcdb57105343180700523771733f8cfe2e7222
HI=INSECURE-WORLD

Edit config file then re-encrypt changed values

License

Licensed under MIT license.

Documentation

Index

• type EnvFile
  • func New(options NewEnvOptions) (*EnvFile, error)
  • func Open(options OpenEnvOptions) (*EnvFile, error)
  • func (env *EnvFile) Export(format string) ([]byte, error)
  • func (env *EnvFile) ExportFile(format, path string, flag int) error
  • func (env *EnvFile) UnsafeRawExport(format string) ([]byte, error)
  • func (env *EnvFile) UpdateFrom(format string, reader io.Reader) error
• type NewEnvOptions
• type OpenEnvOptions
• type SimpleCipher

Types

type EnvFile

type EnvFile struct {
	// contains filtered or unexported fields
}

func New

func New(options NewEnvOptions) (*EnvFile, error)

func Open

func Open(options OpenEnvOptions) (*EnvFile, error)

func (*EnvFile) Export

func (env *EnvFile) Export(format string) ([]byte, error)

func (*EnvFile) ExportFile

func (env *EnvFile) ExportFile(format, path string, flag int) error

func (*EnvFile) UnsafeRawExport

func (env *EnvFile) UnsafeRawExport(format string) ([]byte, error)

func (*EnvFile) UpdateFrom

func (env *EnvFile) UpdateFrom(format string, reader io.Reader) error

type NewEnvOptions

type NewEnvOptions struct {
	Format      string
	Reader      io.Reader
	Cipher      SimpleCipher
	LogLevel    logger.LogLevel
	SecurePaths []string
}

type OpenEnvOptions

type OpenEnvOptions struct {
	Format      string
	Reader      io.Reader
	Cipher      SimpleCipher
	SecurePaths []string
	LogLevel    logger.LogLevel
}

type SimpleCipher

type SimpleCipher interface {
	Encrypt(raw string) (string, error)
	Decrypt(encrypted string) (string, error)
}