While many projects deserve proper secrets handling solution such as Vault, by HashiCorp or AWS KMS, these solutions are often costy and simply an overkill for more simpler setups. However, manually managing environment variables is a pain and prone to much human mistakes.
Meanwhile, git-crypt has been providing a good solution to manage your secrets together with your codebase. Although simple, git-crypt is not really feature rich and not at all focused on this particular use-case alone.
Comes @strv/shh. Together with git-crypt, this tool will help you:
- Encrypt versioned environment variables
- Setup CI usage of these environment variables
- Share environment variables safely with colleagues
- Compare environment variable of different targets
- Switch environments locally
The main idea here is to have a set of environment files (by default at ./envs/env.[name]) that are encrypted using git-crypt, and a .env symbolic link to one of the available environments.
@strv/shh will helps setting this up, and switching/selecting environments both on local machines and on CI.
Make sure to have git-crypt installed. On Mac OS, I recommend using brew.
npm add @strv/shh --devThe first user will be the one to setup @strv/shh on the repository. Execute the following steps:
-
Setup
npx shh init
This command has sensible defaults that can be overriden with extra options. After initialization, make sure to commit all generated files, and changes made to
.gitattributesand.gitignore. -
Save key
You'll need the to provide other users with the encryption key in order to unlock the repository (or for CI usage). Run the following to get the key:
npx shh export-key
The output key can be shared with other developers that are allowed to unlock the environment variables, and used on the CI setup.
Disclaimer: the output is a base64 encoded secret for easier handling.
Whenever doing a fresh clone of the repository, it's necessary to unlock the environment variable files. Having the key generated on the step above, run:
npx shh unlockYou'll be prompted to provide the key.
Different environments (development, production, etc) are defined by their variable declaring files. By default, this files should be found on ./envs/env.[name] (replacing [name] with the environment name).
You can either create new environments by manually create these files, or you can use the following command:
npx shh newThe benefit of using the command is mainly to reuse the template, if set.
Whenever you intend to execute the application under a different environment locally, run the base CLI:
npx shhSetup on CI isn't much different than locally. However, we recommend this shortcut:
SHH_KEY=[key] npx shh -e [environment]SSH_KEY becomes the only environment variable that has to be made available manually on the CI admin setup.
The main problem to use @strv/shh on CI is having git-crypt available, which depends entirely on the OS in use.
Vercel uses an image based on Amazon Linux 2. @strv/shh includes a pre-built git-crypt binary for that image available on @strv/shh/bin/git-crypt--amazon-linux, and this binary will be used by default when executing commands under a Vercel environment, but for safety reasons, we recommend you setup your CI environment following the git-crypt install instructions.
All commands have available options and descriptions available by appending --help to the command.
The following options are available to all commands, and are saved to .shhrc in case they differ from the defaults upon initializing.
| Description | Default | |
|---|---|---|
-t, --target <path> |
The path to the managed env file | ".env" |
-T, --template <path> |
The path to the env template file | "./envs/template" |
-E, --environments <path> |
The path pattern to the environment files | "./envs/env.[name]" |
-l, --log-level <level> |
What level of logs to report (choices: "log", "silent", "warn", "nothing") | "log" |
-c, --copy |
Whether we should install environments using copy instead of symlink | false |
Initialize (npx init)
Initializes @strv/shh and git-crypt setup.
| Description | Default | |
|---|---|---|
-y, --yes |
Confirm YES to warning prompts | prompted |
Switch (npx shh)
Switch to an available environment. Options:
| Description | Default | |
|---|---|---|
-e, --environment <name> |
The environment to switch to | prompted |
Unlock (npx unlock)
Unlock repository using git-crypt. Options:
| Environment variable | Description | Default | |
|---|---|---|---|
-k, --encoded-key <key> |
SHH_KEY |
The base64 encoded key | prompted |
Lock (npx lock)
Locks the repository's and encrypt environment files.
| Description | Default | |
|---|---|---|
-y, --yes |
Confirm YES to warning prompts | prompted |
New environment (npx new)
Create a new environment based on the template. Options:
| Description | Default | |
|---|---|---|
-e, --environment <name> |
The environment to install | prompted |
Diff (npx diff)
Compares variables available on all environments (including template).
Export key (npx export-key)
Outputs a base64 encoded version of the encryption key.