@dotenvx/next-env 3.0.0 → 3.0.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/README.md
CHANGED
|
@@ -1,158 +1,105 @@
|
|
|
1
|
-
|
|
1
|
+
[](https://dotenvx.com)
|
|
2
2
|
|
|
3
|
-
|
|
3
|
+
*A secure dotenv*–from the creator of [`dotenv`](https://github.com/motdotla/dotenv).
|
|
4
4
|
|
|
5
|
-
|
|
5
|
+
* Encrypt
|
|
6
|
+
* Commit
|
|
7
|
+
* Ship
|
|
6
8
|
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
"@dotenvx/next-env": "^2.5.3",
|
|
11
|
-
"next": "^16.0.0"
|
|
12
|
-
},
|
|
13
|
-
"overrides": {
|
|
14
|
-
"@next/env": "npm:@dotenvx/next-env"
|
|
15
|
-
}
|
|
16
|
-
}
|
|
17
|
-
```
|
|
9
|
+
[Install](https://dotenvx.com/docs/install) · [Quickstart](https://dotenvx.com/docs/nextjs/)
|
|
10
|
+
|
|
11
|
+
## Quickstart
|
|
18
12
|
|
|
19
|
-
|
|
13
|
+
`@dotenvx/next-env` replaces Next.js’ `@next/env` loader. In your existing Next.js app, install it.
|
|
20
14
|
|
|
21
15
|
```sh
|
|
22
|
-
npm
|
|
23
|
-
npm run build
|
|
16
|
+
npm install @dotenvx/next-env@^3.0.0
|
|
24
17
|
```
|
|
25
18
|
|
|
26
|
-
|
|
19
|
+
Add the override to your app’s `package.json`.
|
|
27
20
|
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
```sh
|
|
36
|
-
npm ci --prefix next-env
|
|
37
|
-
npm run test:next-env
|
|
21
|
+
```json
|
|
22
|
+
{
|
|
23
|
+
"overrides": {
|
|
24
|
+
"@next/env": "npm:@dotenvx/next-env@^3.0.0"
|
|
25
|
+
}
|
|
26
|
+
}
|
|
38
27
|
```
|
|
39
28
|
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
From a clean Forge checkout, run `npm run version:batch -- next-env major`
|
|
43
|
-
to bump the npm and Cargo versions, commit the bump, and create a matching
|
|
44
|
-
`next-env-vX.Y.Z` tag. Add `--push` on `main` to push the commit and tag and
|
|
45
|
-
trigger `.github/workflows/next-env.yml`. Use `minor` or `patch` for those bumps.
|
|
29
|
+
Run `npm install` again to apply the override.
|
|
46
30
|
|
|
47
|
-
|
|
48
|
-
Linux glibc arm64/x64, and Windows x64. Consumers install it with npm
|
|
49
|
-
without a Rust toolchain.
|
|
31
|
+
`.env`
|
|
50
32
|
|
|
51
|
-
|
|
33
|
+
```dotenv
|
|
34
|
+
HELLO=World
|
|
35
|
+
```
|
|
52
36
|
|
|
53
|
-
|
|
54
|
-
| --- | --- |
|
|
55
|
-
| Organization | `dotenvx` |
|
|
56
|
-
| Repository | `forge` |
|
|
57
|
-
| Workflow filename | `next-env.yml` |
|
|
58
|
-
| Environment | `release` |
|
|
59
|
-
| Allowed action | `npm publish` |
|
|
37
|
+
`app/api/hello/route.js`
|
|
60
38
|
|
|
61
|
-
|
|
39
|
+
```js
|
|
40
|
+
export function GET() {
|
|
41
|
+
return new Response(`Hello ${process.env.HELLO}`)
|
|
42
|
+
}
|
|
43
|
+
```
|
|
62
44
|
|
|
63
|
-
|
|
45
|
+
Run `npm run dev` and open `http://localhost:3000/api/hello` to see `Hello World`.
|
|
64
46
|
|
|
65
|
-
|
|
47
|
+
- Prebuilt Node addons are included for macOS arm64/x64, Linux glibc arm64/x64,
|
|
48
|
+
and Windows x64.
|
|
49
|
+
- Stored key lookup requires a compatible `dotenvx` CLI on `PATH`. Keys in
|
|
50
|
+
`process.env` and `.env.keys` work without the CLI.
|
|
51
|
+
- Armor Enclave server-side decryption is unavailable in v3.
|
|
66
52
|
|
|
67
|
-
|
|
53
|
+
|
|
68
54
|
|
|
69
|
-
|
|
70
|
-
of this software and associated documentation files (the "Software"), to deal
|
|
71
|
-
in the Software without restriction, including without limitation the rights
|
|
72
|
-
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
73
|
-
copies of the Software, and to permit persons to whom the Software is
|
|
74
|
-
furnished to do so, subject to the following conditions:
|
|
55
|
+
## Usage
|
|
75
56
|
|
|
76
|
-
|
|
77
|
-
copies or substantial portions of the Software.
|
|
57
|
+
*Install* dotenvx.
|
|
78
58
|
|
|
79
|
-
|
|
80
|
-
|
|
81
|
-
|
|
82
|
-
|
|
83
|
-
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
84
|
-
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
|
85
|
-
SOFTWARE.
|
|
59
|
+
```sh
|
|
60
|
+
$ curl -sfS https://dotenvx.sh | sh
|
|
61
|
+
◈ installed (2.38.2:/usr/local/bin/dotenvx)
|
|
62
|
+
```
|
|
86
63
|
|
|
87
|
-
|
|
64
|
+
*Encrypt* your secrets in `.env` files. The values become ciphertext and only your private key can unlock them.
|
|
88
65
|
|
|
89
|
-
|
|
66
|
+
```sh
|
|
67
|
+
$ dotenvx encrypt
|
|
68
|
+
◈ encrypted .env (039 BCA) via .env.keys ⛉
|
|
69
|
+
```
|
|
90
70
|
|
|
91
|
-
|
|
71
|
+
*Commit* your encrypted `.env` files with your code. Keep `.env.keys` out of git. The `-f` flag adds the encrypted file when your Next.js project ignores it.
|
|
92
72
|
|
|
93
|
-
|
|
94
|
-
|
|
95
|
-
|
|
96
|
-
|
|
97
|
-
copies of the Software, and to permit persons to whom the Software is
|
|
98
|
-
furnished to do so, subject to the following conditions:
|
|
73
|
+
```sh
|
|
74
|
+
$ git add -f .env
|
|
75
|
+
$ git commit -m "encrypt .env"
|
|
76
|
+
```
|
|
99
77
|
|
|
100
|
-
|
|
101
|
-
copies or substantial portions of the Software.
|
|
78
|
+
*Ship* your code and secrets together. Dotenvx uses your private key to decrypt and inject your secrets just-in-time to your code.
|
|
102
79
|
|
|
103
|
-
|
|
104
|
-
|
|
105
|
-
|
|
106
|
-
|
|
107
|
-
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
108
|
-
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
|
109
|
-
SOFTWARE.
|
|
80
|
+
```sh
|
|
81
|
+
$ npm run dev
|
|
82
|
+
⟐ injected env (2) from .env (039 BCA) via .env.keys ⛉
|
|
83
|
+
```
|
|
110
84
|
|
|
111
|
-
|
|
85
|
+
Set the matching private key, such as `DOTENV_PRIVATE_KEY`, in your deployment environment.
|
|
112
86
|
|
|
113
|
-
|
|
87
|
+
|
|
114
88
|
|
|
115
|
-
|
|
89
|
+
## Design
|
|
116
90
|
|
|
117
|
-
|
|
118
|
-
of this software and associated documentation files (the “Software”), to deal
|
|
119
|
-
in the Software without restriction, including without limitation the rights
|
|
120
|
-
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
121
|
-
copies of the Software, and to permit persons to whom the Software is
|
|
122
|
-
furnished to do so, subject to the following conditions:
|
|
91
|
+
Three widely used and proven primitives make up Dotenvx's design. Git, .env, and secp256k1.
|
|
123
92
|
|
|
124
|
-
|
|
125
|
-
all copies or substantial portions of the Software.
|
|
93
|
+
We chose git because it is the best way to deliver digital goods. It is the container ship of the digital world. All code travels on its ships. Why not secrets? Why invent an inferior secrets delivery mechanism when the world class one is right there at your fingertips.
|
|
126
94
|
|
|
127
|
-
|
|
128
|
-
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
129
|
-
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
|
130
|
-
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
131
|
-
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
132
|
-
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
|
|
133
|
-
THE SOFTWARE.
|
|
95
|
+
We chose .env because it is the open standard for loading secrets into code. It represents environment variables, the core primitive that all secrets end up injected into at runtime of code.
|
|
134
96
|
|
|
135
|
-
|
|
97
|
+
Lastly, we needed to choose an encryption algorithm. Encryption of the values inside the .env file would allow us to place those values with code, leveraging git's distribution advantages while still following the twelve-factor config – by separating the decryption key from the code (environment).
|
|
136
98
|
|
|
137
|
-
|
|
99
|
+
It was important that we choose a proven, simple, asymmetric standard with small keys. We chose secp256k1, battle-tested by Bitcoin for more than seventeen years. We made cryptography an opinionated choice so developers wouldn't have to. Encryption just worked.
|
|
138
100
|
|
|
139
|
-
|
|
140
|
-
Copyright (c) 2016 Thomas Pornin <pornin@bolet.org>
|
|
101
|
+
The result is a system built entirely from primitives, developers already understand, and infrastructure they already use. Secrets can travel with code without becoming part of the code. Git distributes them, .env defines how apps consume them, and secp256k1 keeps their values unreadable. The kicker, all this works by setting a single private key on your infrastructure - no more risky async coordination of secrets, no more centralized downtime risk. Your secrets are always just there with your code, ready to be unlocked at runtime.
|
|
141
102
|
|
|
142
|
-
|
|
143
|
-
of this software and associated documentation files (the “Software”), to deal
|
|
144
|
-
in the Software without restriction, including without limitation the rights
|
|
145
|
-
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
146
|
-
copies of the Software, and to permit persons to whom the Software is
|
|
147
|
-
furnished to do so, subject to the following conditions:
|
|
103
|
+
[Read the whitepaper →](https://dotenvx.com/dotenvx.pdf?v=README)
|
|
148
104
|
|
|
149
|
-
|
|
150
|
-
all copies or substantial portions of the Software.
|
|
151
|
-
|
|
152
|
-
THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
153
|
-
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
154
|
-
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
|
155
|
-
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
156
|
-
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
157
|
-
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
|
|
158
|
-
THE SOFTWARE.
|
|
105
|
+
|
|
Binary file
|
|
Binary file
|
|
Binary file
|
|
Binary file
|
|
Binary file
|