Package: python-dotenv-vault
python-dotenv-vaultExtends the proven & trusted foundation ofpython-dotenv, with a.env.vaultfile.The extended standard lets you load encrypted secrets from your.env.vaultfile in production (and other) environments. Brought to you by the same people that pioneereddotenv-nodejs.🌱 Install🏗️ Usage (.env)🚀 Deploying (.env.vault) 🆕🌴 Multiple Environments❓ FAQ⏱️ Changelog🌱 Installpipinstallpython-dotenv-vault🏗️ UsageDevelopment usage works just likepython-dotenv.Add your application configuration to your.envfile in the root of your project:S3_BUCKET=YOURS3BUCKETSECRET_KEY=YOURSECRETKEYGOESHEREAs early as possible in your application bootstrap process, load .env:importosfromdotenv_vaultimportload_dotenvload_dotenv()# take environment variables from .env.# Code of your application, which uses environment variables (e.g. from `os.environ` or# `os.getenv`) as if they came from the actual environment.When your application loads, these variables will be available inos.environoros.getenv:importoss3_bucket=os.getenv("S3_BUCKET")print(s3_bucket)🚀 DeployingEncrypt your environment variables by doing:npxdotenv-vaultlocalbuildThis will create an encrypted.env.vaultfile along with a.env.keysfile containing the encryption keys. Set theDOTENV_KEYenvironment variable by copying and pasting the key value from the.env.keysfile onto your server or cloud provider. For example in heroku:herokuconfig:setDOTENV_KEY=<keystringfrom.env.keys>Commit your .env.vault file safely to code and deploy. Your .env.vault fill be decrypted on boot, its environment variables injected, and your app work as expected.Note that when theDOTENV_KEYenvironment variable is set, environment settings willalwaysbe loaded from the.env.vaultfile in the project root. For development use, you can leave theDOTENV_KEYenvironment variable unset and fall back on thedotenvbehaviour of loading from.envor a specified set of files (seehere in thedotenvREADMEfor the details).🌴 Manage Multiple EnvironmentsYou have two options for managing multiple environments - locally managed or vault managed - both usedotenv-vault.Locally managed never makes a remote API call. It is completely managed on your machine. Vault managed adds conveniences like backing up your .env file, secure sharing across your team, access permissions, and version history. Choose what works best for you.💻 Locally ManagedCreate a.env.productionfile in the root of your project and put your production values there.# .env.productionS3_BUCKET="PRODUCTION_S3BUCKET"SECRET_KEY="PRODUCTION_SECRETKEYGOESHERE"Rebuild your.env.vaultfile.npxdotenv-vaultlocalbuildView your.env.keysfile. There is a productionDOTENV_KEYthat pairs with theDOTENV_VAULT_PRODUCTIONcipher in your.env.vaultfile.Set the productionDOTENV_KEYon your server, recommit your.env.vaultfile to code, and deploy. That's it!Your .env.vault fill be decrypted on boot, its production environment variables injected, and your app work as expected.🔐 Vault ManagedSync your .env file. Run the push command and follow the instructions.learn more$ npx dotenv-vault pushManage multiple environments with the included UI.learn more$ npx dotenv-vault openBuild your.env.vaultfile with multiple environments.$ npx dotenv-vault buildAccess yourDOTENV_KEY.$ npx dotenv-vault keysSet the productionDOTENV_KEYon your server, recommit your.env.vaultfile to code, and deploy. That's it!❓ FAQWhat happens ifDOTENV_KEYis not set?Dotenv Vault gracefully falls back topython-dotenvwhenDOTENV_KEYis not set. This is the default for development so that you can focus on editing your.envfile and save thebuildcommand until you are ready to deploy those environment variables changes.Should I commit my.envfile?No. Westronglyrecommend against committing your.envfile to version control. It should only include environment-specific values such as database passwords or API keys. Your production database should have a different password than your development database.Should I commit my.env.vaultfile?Yes. It is safe and recommended to do so. It contains your encrypted envs, and your vault identifier.Can I share theDOTENV_KEY?No. It is the key that unlocks your encrypted environment variables. Be very careful who you share this key with. Do not let it leak.ContributingFork itCreate your feature branch (git checkout -b my-new-feature)Commit your changes (git commit -am 'Added some feature')Push to the branch (git push origin my-new-feature)Create new Pull RequestChangelogSeeCHANGELOG.mdLicenseMITChangelogAll notable changes to this project will be documented in this file. Seestandard-versionfor commit guidelines.Unreleased## 0.6.4### ChangedBump Cryptography above 41.0.3 to resolve#19(High severityCVE-2023-38325)0.6.3ChangedFixed a bug where it was looking up .env instead of .env.vault#180.6.2ChangedLook for .env.vault file at same location as .env file. Finds .env file anywhere in app (just like original python lib)#130.6.1ChangedFix fallback issue with gunicorn not respecting the current working directory when attempting to callfind_dotenv.#170.6.0ChangedFix environment variable load#120.5.1ChangedFix error reference#100.5.0AddedReorganise and simplify codeMake API correspond more closely topython-dotenvImprove error handlingAdd tests and CIUpgrade tobuildfor release build0.4.1Addedexpand cryptography library version range for better support0.4.0AddedAdded feature to allow custom .env.vault path0.3.0AddedAdded backward compatibility python version 3.7+0.2.0AddedAdded comma separated capability toDOTENV_KEY. Add multiple keys to your DOTENV_KEY for use with decryption. Separate with a comma.0.1.1AddedAdded support for handling any environment0.1.0AddedAdded README and CHANGELOG0.0.9AddedDecrypting .env.vault file whenDOTENV_KEYis set.0.0.8 and priorPlease see commit history.