Package: secretsintheenv
♬♬♪ Secret is in the env, everywhere I look around    ♪♬♬♪♬♪ Secret is in the env, every token and every vault ♪♬♪♪♪♬ And I don't know if I'm being foolish             ♬♬♪♪♪♪ Don't know if I'm being wise                      ♬♪♬♬♪♪ But it's something that I must have in            ♬♬♬♬♬♪ And it's there when I avoid in my file             ♬♬♪Secrets in the envWelcome to this simple project, an application launcher to load your secrets in environment variables or SSH private keys into your system's SSH agent, stored in a compatible vaultTo-DoAdd Hashicorp Vault as a vault compatibleRequirementsCompatible Operative Systems as hostMacOS (including Chip M1 and M2)GNU/LinuxWindows 10/11/Servers (including SSH-Agent).For installing OpenSSH on Windows, seehttps://learn.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse?tabs=guiSoftwarePython 3:https://www.python.org/Dependences:PyKeePass:https://github.com/libkeepass/pykeepassCurrent compatible vaultsKeePaas 2:https://keepass.info/How to useInstallInstall on Unix-Like and MacOS:$ pip install secretsintheenvOn WindowsPowerShellPS C:\> pip install secretsintheenvCMDC:\> pip install secretsintheenvNote:Hereinafter, to run on Windows you should add the .exe suffix to command
Ex:On Unix-Like:$ ./secretsintheenv -hOn Windows:PS C:\> secretsintheenv.exe -hNote:In order to run:$ secretsintheenv <arguments>PS C:\> secretsintheenv.exe <arguments>It is necessary to install with ADMIN RIGHTS (Using SUDO on Unix-Like or RUNAS on Windows, or similar)If you install the pip packages with simple users privileges, you have to replace the command above by:$  python -m secretsenv.secretsenv <arguments>PS C:\> python.exe -m secretsenv.secretsenv <arguments>HelpJust run:$ secretsintheenv -hSet-UpFollow the next steps to reach out a good experience using this tool.Step 1First of all, you have to create your .secretsenv.conf config file on your home directory with the following content:$ cat $HOME/.secretsenv.comf
[Config]
ssh = True
ssh-agent_type = ssh-agent
ssh-agent_path = /usr/bin/ssh-agent
vaults_file = /Path/to/vaults.conf
profiles_dir = /Path/to/profiles/directory/ssh(mandatory): enable or disable SSH-Agentssh-agent_type(optional): just suport "ssh-agent" right nowssh-agent_path(optional): set the path of ssh-agent you prefer usingvaults_file(mandatory): the file path where stored the vaults configurations. Also, it can be replaced bySECRETSENV_VAULTS_FILEenvironment variableprofiles_dir(optional): the directory path where stored the profile files. Also, it can be replaced bySECRETSENV_PROFILES_DIRenvironment varaibleNote:Attributes can be set or replaced by command lines arguments. (See Help section)Line with Hashtags (#) in the beginning are considered commentsNote:The .secretsenv.conf file and path can be replaced by using SECRETSENV_CONFIG_FILE environment variable. If you prefer using your own file, bear in mind to replace .secretsenv.conf by yours until the rest of this README.Step 2Once configured the .secretsenv.conf, the next step is to create the vaults file configuration in the path set within .secretsenv.conf$ cat /Path/to/vaults.conf
[Section_Name]
type=<type of vault>
<attribute1>=<choose action>
<attribute2>=<choose action>
<attribute3>=<choose action>
[...][Section_Name](mandatory, Case Insensitive): Start a new section into file. Section_Name can be any name as you prefer, but it must be unique.type(manddatory, Case sensitive): Set the type of vault to be used. (See the Vaults section)attribute(case sensitive): The specific attribute to setup the specific vault.The type of attribute depends on the vault to configureSee the Vaults sectionfor further information.The <choose action> value can be the following:prompt. To prompt in the screen and write the valueVAULT_NAME:QUERYSTR. To get the value from another vault.VAULT_NAMEis the name of vault to be used set as [Section_Name] andQUERYSTRis the query string to retrieve the expected value.You can write as many sections as you need, but remember not to repeat the name of the sections.Note:To see exampled, please visit the sectionExamplesStep 3So, we only need one file more (at least). We need to define the profile file (or several) to create the specific querys to retrieve our loved secrets.The file can be named as you prefer, but it must include the suffix .secrets to work, and a content such as:$ cat /Path/to/profiles/directory/PROFILE_NAME.secrets
[Section_Name]
<TYPE>@<TAGNAME1>=<VAULT_NAME1>:<QUERYSTR>
<TYPE>@<TAGNAME2>=<VAULT_NAME2>:<QUERYSTR>
<TYPE>@<TAGNAME3>=<VAULT_NAME3>:<QUERYSTR>
[...]Similar to Vaults configuration file, you can define different sections by using the name you prefer, but unique by file, and then, set the different secrets you need to retrieve from specific vault.Note:The sections can be defined as you prefer, but one way to use it can be to define different work environments (Prod, Qua, Stage, Dev, ...) and thus obtain the different secrets that your project requires at all times<TYPE>: Can be:VAR: To retrieve the secret such as environment variableSSH: To add the secret into SSH-AGENT running in your system<TAGNAME>: The name to identify the retrieved secret. WhenVARis used, the TAGNAME will be the environment variable name<VAULT_NAME>: The vault name configured into vault configuration file<QUERYSTR>: The query string (specific by type of vault) to retrieve the secretJust runOnce all requirements are configured, just use the tool as follows:$ secretsintheenv profile profile_section action commandprofile: If not a path is set to a file, the tool will find your file into the "<profiles_dir>/.secrets" configured into the .secretsenv.conf fileprofile_section: To indicate the secrets to be retrieved written in the specific section within the profile fileaction:run: to run the command set in the "command" argumentdump: to dump on screen the secrets content by the format set in the "command" argumentExamplesAssuming the following configured files:$ cat $HOME/.secretsenv.conf
 [Config]
 ssh = True
 #ssh-agent_type = ssh-agent
 #ssh-agent_path = /usr/bin/ssh-agent
 vaults_file = /Path/to/vaults.conf
 profiles_dir = /Path/to/profiles/directory$ cat /Path/to/vaults.conf
[Personal]
type=keepass
db_path=/Path/to/Personal.kdbx
password=prompt
keyfile=/Path/to/Personal.key

[Project]
type=keepass
db_path=/Path/to/Project.kdbx
password=Personal:/Head Vaults/Project#field:password
keyfile=/Path/to/Project.keyNote:Projectwill retrieve the keepass password from thePersonalvault, andPersonalvault willpromptthe password on screen to the user$ cat /Path/to/profiles/directory/project.secrets
[QUA]
VAR@AWS_ACCESS_KEY_ID=Project:/path/to/record1#field:aws_access_keyid
VAR@AWS_SECRET_ACCESS_KEY=Project:/path/to/record2#field:aws_secret_access_key


[Prod]
VAR@AWS_ACCESS_KEY_ID=Project:/path/to/record1#field:aws_access_keyid
VAR@AWS_SECRET_ACCESS_KEY=Project:/path/to/record2#field:aws_secret_access_key
SSH@JUMP_SERVER1:Personal:/path/to/record20#attach:jump_server1.txtDUMP IT!!And just dump it to get the list of secrets on screen:$ secretsintheenv project prod dump tableor, set the project file path$ secretsintheenv /Path/to/profiles/directory/project.secrets prod dump tableOr, Get the environment variables to be directly used:powershell_shell:PS C:\> secretsintheenv.exe C:/Path/to/profiles/directory/project.secrets prod dump powershell_shellcmd_shell:PS C:\> secretsintheenv.exe project prod dump cmd_shellunix_shell:$ secretsintheenv project.secrets prod dump unix_shellOr, even, to eval the results to load the variables in the current environment:$ eval $(secretsintheenv /Path/to/profiles/directory/project.secrets prod dump unix_shell)RUN IT!!!Or, if you prefer, just run a command with the loaded secrets in memory (and SSH Key into SSH-Agent)On Unix-Like systems:$ secretsintheenv project.secrets prod run /bin/bash$ secretsintheenv /Path/to/profiles/directory/project.secrets prod run /bin/zshOn Windows systems:PS C:\> secretsintheenv.exe C:/Path/to/profiles/directory/project.secrets prod run /bin/zshC:\> secretsintheenv.exe project prod run /bin/zshVAULTSKeePaasVaults attributes:type=keepass (Mandatory)db_path= #Path to .kdbx file (Mandatory)password= #if used, the password to unencrypt the db_path filekeyfile= #if used, the keyfile to unencrypt the db_path fileQuery string format (QUERYSTR):QUERYSTR format is:/path/to/record/into/keepass/file#record_type:record_name/path/to/record/into/keepass/fileis the path to the record where the secret is stored in the KeePass databaserecord_type: can get the following values:field. To indicate that the secret is stored in a fieldattach. To indicate that the secret is stored as an attachmentrecord_name: The name of field or attachment where is stored the secretExample:
[...]
VAR@AWS_ACCESS_KEY_ID=Project:/path/to/record1#field:aws_access_keyid
[...]