Package: secrets-vault
secrets-vaultSimple tool to keep your app secrets encrypted in-repo, decrypt using amaster.key.The vault can be YAML (default) or JSON encoded, and is encrypted usingAES-GCM-256 authenticated encryption.Inspired by Rails credentials - it pairs nicely withmrsk. But it can be used as a standalone CLI tool or as a library.Quick startInstall it:$pipinstallsecrets-vaultCreate a new vault:$secretsinit

Generatednewsecretsvaultat./secrets.yml.enc
Generatednewmasterkeyat./master.key-keepitsafe!Open vault in your editor:$secretsedit# Add your secrets below, comments are supported too.# dev:#     secret-key: abc123## database-url: postgres://user:pass@localhost:5432/devRead secrets:$secretsgetdatabase-url

>postgres://user:pass@localhost:5432/devConsume secrets as environment variables:$secretsenvify-odotenv

$cat.env

>DATABASE_URL=postgres://...
>REDIS_URL=redis://...
>COOKIE_SECRET=abc123Important:You should keep themaster.keysecret, do NOT commit it. Ignore it in your.gitignorefile. Thesecrets.yml.encfile is encrypted and can be committed.CLI usageYou can view the help anytime by runningsecrets --help:Usage: secrets [OPTIONS] COMMAND [ARGS]...

  Manage a local secrets vault.

Options:
  -s, --secrets-filepath TEXT     Path to the encrypted secrets vault.
                                  [default: ./secrets.yml.enc]
  -m, --master-key-filepath TEXT  Path to the master.key file.  [default:
                                  ./master.key]
  -f, --format [yaml|json]        Format to use for the secrets vault.
                                  [default: yaml]
  -v, --verbose                   Enable verbose output.
  --help                          Show this message and exit.

Commands:
  del      Delete a secret.
  edit     Open the secrets vault in your configured $EDITOR.
  envify   Prints a provided secret key as one or more env variables.
  get      Get a secret value.
  init     Generate a new secrets vault and master.key pair.
  set      Store a secret.
  version  Show the package version.Reading secretsCLI commandsList all secrets:$secretsget# Add your secrets below, comments are supported too.# dev:#     secret-key: abc123## database-url: postgres://user:pass@localhost:5432/devGet a secret:$secretsgetdatabase-url
>postgres://user:pass@localhost:5432/devTraverse nested objects:$secretsget

dev:secret-key:abc123admins:[zero,one,twothree]database-url:postgres://user:pass@localhost:5432/dev$secretsgetdev.admins.2

>twoIn PythonSimply callgetwith the key. Note that if the secret is missing it will returnNonefromsecrets_vaultimportSecretsVaultvault=SecretsVault()admins=vault.get('dev.admins')Editing secretsCLI commandYou can set secrets from the CLI with a key and value:$secretssetfoobarInteractive editorTo edit secrets, runsecrets edit, the file will be decrypted and your editor will open.$secretsedit

>>Openingsecretsfileineditor...# Add your secrets below, comments are supported too.# dev:#     secret-key: abc123## database-url: postgres://user:pass@localhost:5432/devAny saved changes will be encrypted and saved to the file on disk when you close the editor.In PythonYou can also edit secrets from code:fromsecrets_vaultimportSecretsVaultvault=SecretsVault()vault.set('foo','bar')vault.save()Deleting secretsCLI commandYou can delete secrets from the CLI with a key:$secretsdelfooIn PythonYou can achieve the same in Python like this:fromsecrets_vaultimportSecretsVaultvault=SecretsVault()vault.delete('foo')vault.save()Printing secrets as environment variablesSometimes you may want to print a secret as environment variables. It will also apply if you have nested objects. You can do so by running:$secretsedit

aws-credentials:aws-access-key-id:abc123aws-secret-access-key:abc456database-url:postgres://user:pass@localhost:5432/devEnvify will print the secrets ready for consumption as environment variables:$secretsenvifyaws-credentialsAWS_ACCESS_KEY_ID=abc123AWS_SECRET_ACCESS_KEY=abc456You can also print the entire vault as environment variables:$secretsenvifyAWS_CREDENTIALS={"aws-access-key-id":"abc123","aws-secret-access-key":"abc456"}DATABASE_URL=postgres://user:pass@localhost:5432/devThe following conventions are applied:The key is uppercasedDashes are replaced with underscoresValues are serialized as plain-text (eg. strings and numbers)Objects are JSON encoded (eg. lists and dicts)Consuming the output of envifyYou can then use it in your shell like this:$$(secretsenvify--exportaws-credentials)$echo$AWS_ACCESS_KEY_IDabc123Dump output to a dotenv file:$secretsenvifyaws-credentials-o.env.aws
$cat.env.aws
>AWS_ACCESS_KEY_ID=abc123
>AWS_SECRET_ACCESS_KEY=abc456Providing the master.key fileFile on diskBy default, the vault will look for the master key in a file located at./master.key.Environment variableYou can also provide it via an environment variableMASTER_KEY. For example:MASTER_KEY=my-super-secret-master-keysecretseditWhen a master key is provided via an environment variable, it takes precedence over the file on disk.In PythonYou can load the master_key from anywhere else and provide it when initializing the class:fromsecrets_vaultimportSecretsVault# Load from somewhere elsemaster_key='my-super-secret-master-key'vault=SecretsVault(master_key=master_key)The order of precedence for the master key is:Provided via the constructorProvided via theMASTER_KEYenvironment variableLoaded from the file on diskConfiguring the default filepathsCLI commandYou can also provide them as a CLI arguments before the command:$secrets\--master-key-filepath./prod/master.key\--secrets-filepath./prod/secrets.yml.enc\initThis can be used to separate your secrets by environments such asprod,staging,dev, each having with their own key.In PythonYou can also configure the filepaths at which yoursecrets.yml.encandmaster.keyfiles are located.fromsecrets_vaultimportSecretsVaultvault=SecretsVault(master_key_filepath=...,secrets_filepath=...)ChangelogSeeCHANGELOGfor the list of releases.Security DisclosureIf you discover any issue regarding security, please disclose the information responsibly by sending an email todyer.linseed0@icloud.com. Do NOT create a Issue on the GitHub repo.ContributingPlease check for any existing issues before openning a new Issue. If you'd like to work on something, please open a new Issue describing what you'd like to do before submitting a Pull Request.LicenseSeeLICENSE.