@sharedenv/cli 0.1.0 → 1.0.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +103 -6
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -3,7 +3,7 @@
|
|
|
3
3
|
**The zero-knowledge secrets vault for teams, in your terminal.**
|
|
4
4
|
|
|
5
5
|
[](https://www.npmjs.com/package/@sharedenv/cli)
|
|
6
|
-
[](LICENSE)
|
|
7
7
|
|
|
8
8
|
Your `.env` files have no business in Slack, in an email or in a git repo. With
|
|
9
9
|
[sharedenv](https://sharedenv.com), your team keeps its environment variables, API keys and
|
|
@@ -64,15 +64,112 @@ is passed through, so scripts and CI behave exactly as without sharedenv.
|
|
|
64
64
|
A variable your shell already sets wins over the vault, so a local `DATABASE_URL` is never
|
|
65
65
|
replaced behind your back: add `--override-env` when you want the vault's value.
|
|
66
66
|
|
|
67
|
-
###
|
|
67
|
+
### Get your secrets as a file, or as JSON
|
|
68
68
|
|
|
69
69
|
```bash
|
|
70
|
-
sharedenv pull prod
|
|
71
|
-
sharedenv pull prod --
|
|
70
|
+
sharedenv pull prod # dotenv, on stdout
|
|
71
|
+
sharedenv pull prod --out .env # the same, in a file only you can read
|
|
72
|
+
sharedenv pull prod --format json # JSON, for scripts and programs
|
|
72
73
|
```
|
|
73
74
|
|
|
74
|
-
|
|
75
|
-
|
|
75
|
+
stdout carries the secrets and nothing else (questions and messages go to stderr), so
|
|
76
|
+
pipes and redirections get clean data. From a script or a program there is no terminal to
|
|
77
|
+
ask for your master password: set `SHAREDENV_PASSWORD`.
|
|
78
|
+
|
|
79
|
+
#### dotenv (the default)
|
|
80
|
+
|
|
81
|
+
For a vault holding five secrets, `sharedenv pull prod` prints:
|
|
82
|
+
|
|
83
|
+
```dotenv
|
|
84
|
+
APP_NAME='Acme billing'
|
|
85
|
+
DATABASE_URL=postgres://app:s3cret@db.internal:5432/app
|
|
86
|
+
JWT_PRIVATE_KEY='-----BEGIN PRIVATE KEY-----
|
|
87
|
+
MIIEvQIBADANBgkqhkiG9w0BAQEFAASC
|
|
88
|
+
-----END PRIVATE KEY-----'
|
|
89
|
+
SMTP_PASSWORD="it's a pass"
|
|
90
|
+
STRIPE_KEY=sk_test_example
|
|
91
|
+
```
|
|
92
|
+
|
|
93
|
+
- One `NAME=value` per secret, sorted by name, so two pulls of the same vault give the
|
|
94
|
+
same file.
|
|
95
|
+
- A value is written as is when it holds only plain characters, between single quotes
|
|
96
|
+
otherwise (multi-line values such as a PEM key included), and between double quotes when
|
|
97
|
+
it contains a single quote.
|
|
98
|
+
- Nothing is ever expanded or executed when the file is read. A value that no quoting can
|
|
99
|
+
carry safely (a single quote together with `"`, `$`, a backtick or `\`) is refused with
|
|
100
|
+
its name: use `--format json` for that vault.
|
|
101
|
+
|
|
102
|
+
Every common reader loads it as is:
|
|
103
|
+
|
|
104
|
+
```bash
|
|
105
|
+
set -a; . ./.env; set +a # a shell (bash, zsh, sh)
|
|
106
|
+
node --env-file=.env server.js # Node.js 20.12 or later
|
|
107
|
+
```
|
|
108
|
+
|
|
109
|
+
```js
|
|
110
|
+
import 'dotenv/config'; // Node.js, with the dotenv package
|
|
111
|
+
```
|
|
112
|
+
|
|
113
|
+
```python
|
|
114
|
+
from dotenv import load_dotenv # Python, with python-dotenv
|
|
115
|
+
load_dotenv()
|
|
116
|
+
```
|
|
117
|
+
|
|
118
|
+
One exception: `docker run --env-file` reads values literally (it would keep the quotes)
|
|
119
|
+
and refuses multi-line values. Hand the variables to Docker through `run` instead:
|
|
120
|
+
|
|
121
|
+
```bash
|
|
122
|
+
sharedenv run prod -- docker run -e DATABASE_URL -e STRIPE_KEY my-app
|
|
123
|
+
```
|
|
124
|
+
|
|
125
|
+
#### JSON
|
|
126
|
+
|
|
127
|
+
`sharedenv pull prod --format json` prints one object, names sorted, every value a string:
|
|
128
|
+
|
|
129
|
+
```json
|
|
130
|
+
{
|
|
131
|
+
"APP_NAME": "Acme billing",
|
|
132
|
+
"DATABASE_URL": "postgres://app:s3cret@db.internal:5432/app",
|
|
133
|
+
"JWT_PRIVATE_KEY": "-----BEGIN PRIVATE KEY-----\nMIIEvQIBADANBgkqhkiG9w0BAQEFAASC\n-----END PRIVATE KEY-----",
|
|
134
|
+
"SMTP_PASSWORD": "it's a pass",
|
|
135
|
+
"STRIPE_KEY": "sk_test_example"
|
|
136
|
+
}
|
|
137
|
+
```
|
|
138
|
+
|
|
139
|
+
One value, from a shell:
|
|
140
|
+
|
|
141
|
+
```bash
|
|
142
|
+
sharedenv pull prod --format json | jq -r .DATABASE_URL
|
|
143
|
+
```
|
|
144
|
+
|
|
145
|
+
From a program:
|
|
146
|
+
|
|
147
|
+
```js
|
|
148
|
+
// Node.js
|
|
149
|
+
import { execFileSync } from 'node:child_process';
|
|
150
|
+
|
|
151
|
+
const secrets = JSON.parse(
|
|
152
|
+
execFileSync('sharedenv', ['pull', 'prod', '--format', 'json'], { encoding: 'utf8' })
|
|
153
|
+
);
|
|
154
|
+
console.log(secrets.DATABASE_URL);
|
|
155
|
+
```
|
|
156
|
+
|
|
157
|
+
```python
|
|
158
|
+
# Python
|
|
159
|
+
import json
|
|
160
|
+
import subprocess
|
|
161
|
+
|
|
162
|
+
secrets = json.loads(
|
|
163
|
+
subprocess.run(
|
|
164
|
+
["sharedenv", "pull", "prod", "--format", "json"],
|
|
165
|
+
check=True, capture_output=True, text=True,
|
|
166
|
+
).stdout
|
|
167
|
+
)
|
|
168
|
+
print(secrets["DATABASE_URL"])
|
|
169
|
+
```
|
|
170
|
+
|
|
171
|
+
If the command fails (wrong password, unknown vault, no network), it exits with a non-zero
|
|
172
|
+
code and says why on stderr: `execFileSync` throws, and `check=True` raises.
|
|
76
173
|
|
|
77
174
|
### Accept what your team shares with you
|
|
78
175
|
|