Package: envrun
envrunis a CLI tool that runs a command with dynamically-sourced env variables.Sick of scrubbing secrets from.bash_history?
Do your fingers hurt from hitting ctrl+c and ctrl+v
while copying the API token - for 154th time?
This is a tool for you.When working on software projects it is often difficult to manage application secrets in a sane way.
We're dealing with more API keys and certificates than ever!Sure, there are solutions out there. Some of them even work just fine!So... why a new tool? I wanted something that would fit into many different workflows.
When locally running commands that need to have access to secrets, managing deployments with multiple differing sets
of variables, injecting secrets into config files,...Inenvruna variable can be sourced from a file, output of an arbitrary coommand, from the environment, or from anycompatible backend.This tool is still under heavy development and its API might change at any time. Use with caution.InstallationTo install using pip, run:pip install envrunOther installation options are not yet available.UsageUsage: envrun [OPTIONS] COMMAND...

Execute COMMAND with env variables from .envrun

If COMMAND uses flags, prepend it with " -- ".

Options:
--non-interactive  Don't prompt for missing variable values.
--isolated         Don't pass the variables from the outer environment.
--help             Show this message and exit.For debugging, invoke theenvcommand, which should be available on most Unix-like systems:envrun envIf invoking a COMMAND which uses flags, prepend it with " -- ":envrun -- ls -alIf wanting to execute multiple commands within the same environment, COMMAND can be passed as a quoted string:envrun "ls -a | sort".envrun.toml fileEnvrun starts searching for a .envrun.toml file in the current working directory, checking parent directories
if no .envrun.toml file is found.Variables are namespaced using the following convention:vars.<backend>.<var_name> = <var>The following lines are equivalent:vars.<backend>.<var_name> = { key="x }
vars.<backend>.<var_name> = "x"The "key" has a backend-specific meaning. Generally, it represents
the most commonly-used setting for a particular backend.Seehttps://toml.io/for file format specifics.Example# Variable LS will be set to the output of `ls -al`
vars.shell.LS = "ls -al"

# MY_PATH will be set to the value of $PATH.
vars.env.MY_PATH = "PATH"

[vars.const]
    # Hardcoded vars can be placed here.
    ENV = "development"
    TWO = "2"

[vars.file.SSH_PUBKEY]
    # SSH_PUBKEY will be set to the contents of id_rsa.pub.
    key = "~/.ssh/id_rsa.pub"Use cases12-Factor appsAccording to theTwelve-Factor Appmethodology, app secrets should be configured from the environment.envruncan neatly support this workflow by keeping the.envrun.tomlconfig files in version control and sourcing the config values
from storage backends.Infrastructure as codeWhen running configuration managament and Infrastructure as Code tools, there is often a need to inject secrets into the tool.
Different tools have different ways of handling configuration and secret managament, and they can rarely work together.Environment variables provide a common ground, as they are supported by the majority of popular tools.This is whereenvruncomes into play - it provides a concise and extensible way of defining and passing the variables to tools liketerraformandansible.Generating config filesCombined with the excelentenvsubst,envruncan be used as a rudimentary templating engine.envrun envsubst < nginx.conf.tmpl > nginx.confThis will generatenginx.conffromnginx.conf.tmpland replace all strings like$VARor${VAR}with their values - as provided byenvrun.BackendsconstUsed for setting static env variables.[vars.const]
PATH = "/usr/bin"fileUsed for setting a variable to contents of a file.[vars.const]
PUBKEY = "~/.ssh/id_rsa.pub"envGenerally useful only when used with--isolated. Used for passing or renaming specific env vars.[vars.env]
RENAMED_PATH = "PATH"shellUsed for setting static env variables.[vars.shell]
GIT_REF = "git show-ref | head -1"keyringThe keyring backend currently supports key stores implementing freedesktop.org secret service protocol;
most notably Gnome keyring and KSecretsService. MacOS and Windows is still a work in progress.Additionally, from version 2.5 KeepassXC should also work on systems that are D-Bus enabled (Linux). Seehttps://avaldes.co/2020/01/28/secret-service-keepassxc.htmlfor details.[vars.keyring.MY_SECRET]
key = "my-secret"Extensionsenvrun-vault(pre-alpha)ContributingCreate a virtualenvpython3 -m venv venv
. venv/bin/activateInstall the package:pip install -e ".[dev]"Make your changes.Run code formatter:black envrunAnd finally: create a pull request.Changes0.0.6 (Unreleased)Nothing yet0.0.4Use Toml instead of ini files for configRemove --prefix; namespacing will be implemented differentlyUpdate config file formatAdd support for 3rd party storage backendsMake interactive mode the defaultPass env vars from the outer environment, unless --isolated is usedTemporarily remove --config flagUse parent directories to search for config filesenvrun now executes the supplied command in a subshell