envr is a binary application that tracks your .env files in an encyrpted sqlite database. Changes can be effortlessly synced with envr sync, and restored with envr restore.

envr puts all your .env files in one safe place, so you can back them up with the tool of your choosing.

Features

🔐 Encrypted Storage: All .env files are encrypted using your ssh key and age encryption.
🔄 Automatic Sync: Update the database with one command, which can easily be run on a cron.
🔍 Smart Scanning: Automatically discover and import .env files in your home directory.
✨ Interactive CLI: User-friendly prompts for file selection and management.
🗂️ Rename Detection: Automatically finds and updates renamed/moved repositories.

TODOS

Rename Detection: automatically update moved files.
Allow use of keys from ssh-agent
Allow configuration of ssh key.
Allow multiple ssh keys.

Prerequisites

An SSH key pair (for encryption/decryption)
The following binaries:
- fd
- git

Installation

With Go

If you already have go installed:

go install github.com/sbrow/envr
envr init

With Nix

If you are a nix user

Try it out

nix run github.com:sbrow/envr --

Install it

# /etc/nixos/configuration.nix
{ config, envr, system, ... }: {
  environment.systemPackages = [
    envr.packages.${system}.default
  ];
}

Quick Start

Check out the man page for the quick setup guide.

Disclaimers

Caution

Do not lose your SSH key pair! Your backup will be lost forever.

Commands

See the docs for the current list of available commands.

Configuration

The configuration file is created during initialization:

# Example ~/.envr/config.json
{
  "keys": [
    {
      "private": "/home/ubuntu/.ssh/id_ed25519",
      "public": "/home/ubuntu/.ssh/id_ed25519.pub"
    }
  ],
  "scan": {
    "matcher": "\\.env",
    "exclude": "*.envrc",
    "include": "~"
  }
}

Backup Options

envr merely gathers your .env files in one local place. It is up to you to back up the database (found at ~/.envr/data.age) to a secure and remote location.

Git

envr preserves inodes when updating the database, so you can safely hardlink ~/.envr/data.age into your GNU Stow, Home Manager, or NixOS repository.

Caution

For maximum security, only save your data.age file to a local (i.e. non-cloud) git server that you personally control.

I take no responsibility if you push all your secrets to a public GitHub repo.

restic

restic.

License

This project is licensed under the MIT License.

Support

For issues, feature requests, or questions, please open an issue.