Package: django-encrypted-secrets
django-encrypted-secretsdjango-encrypted-secretsbringsRails-style credential encryptionto theDjango web framework.InstallationTo installdjango-encrypted-secrets, first pip install the module:$ pip install django-encrypted-secretsAddencrypted_secretsto INSTALLED_APPS in your django settings file:INSTALLED_APPS = [
    ...
    'encrypted_secrets'
]Finally, you must callload_secrets()from within yourmanage.pyandwsgi.pyfiles:wsgi.py:#!/usr/bin/env python
import os
import sys
from encrypted_secrets import load_secrets

if __name__ == "__main__":
    load_secrets()
    os.environ.setdefault("DJANGO_SETTINGS_MODULE", "yourapp.settings")
    # ...manage.py:from encrypted_secrets import load_secrets, YAMLFormatException

try:
    load_secrets()
except YAMLFormatException:
    print("\n\n\nMALFORMED YAML IN ENCRYPTED SECRETS\n\n\n")

os.environ.setdefault("DJANGO_SETTINGS_MODULE", "yourapp.settings")
# ...Usagedjango-encrypted-secretsworks by using a key (stored locally inmaster.keyfile or read from the environment variableDJANGO_MASTER_KEY) and reading/writing secrets to the encrypted filesecrets.yml.enc../manage.py init_secretsYou can edit the secrets by running:./manage.py edit_secretsWhen you save the file in your editor, its contents are encrypted and used to overwrite thesecrets.yml.encfile.Finally, to read secrets within your codebase, use theget_secretutility:from encrypted_secrets import get_secret

# ...

secret_api_key = get_secret("secret_api_key")You should always keep yourmaster.keyfile.gitignored.env mode (experimental)django-encrypted-secretsexperimentally supports loading key-value pairs from an encrypted file written in thedotenvformat directly into the environment. To use this style of variable loading, you must passenv_mode=Trueto yourload_secretscall inmanage.pyandwsgi.py:#!/usr/bin/env python
import os
import sys
from encrypted_secrets import load_secrets

if __name__ == "__main__":
    load_secrets(env_mode=True) # <- important
    os.environ.setdefault("DJANGO_SETTINGS_MODULE", "yourapp.settings")
    # ...You must also pass the--mode=envflag to theinit_secretsmanagement command when initializingdjango-encrypted-secrets:$ ./manage.py init_secrets --mode=envA template encrypted dotenv-type file will be written tosecrets.env.enc. When using env mode, secrets are automatically added to the environment. This means that, in addition to being able to read secrets using theget_secrethelper method, you may also read them as ordinary environment variables. If an environment variable configured in the file already exists in the environment, it willnotbe overriden. This is because we assume that you may want to override variables fromdjango-encrypted-secretswith environment variables set in your deployment environment.Example of reading environment variables directly from the environment and usingget_secret:import os
from encrypted_secrets import get_secret

# option 1 - read directly from the environment:
secret_api_key = os.environ.get('SECRET_API_KEY')

# option 2 - use get_secret:
secret_api_key = get_secret('SECRET_API_KEY')Production considerationsdjango-encrypted-secretslooks for the encrypted secrets file within the current working directory from which you execute management commands (usingos.getcwd()). This is implicitly the project root directory. Depending on your production server configuration,os.getcwd()may not actully return the project root. For production, we therefore recommend you explicitly set aDJANGO_SECRETS_ROOTenvironment variable pointing to the project root to hint todjango-encrypted-secretswhere it should look for the encrypted secrets file.