Encryption Example

Supported encryption algorithms include AES-GCM and Fernet. These allow envstack to securely encrypt and decrypt sensitive environment variables.

Base64 encoding is also supported as a convenience, but it is not encryption.

To use AES-GCM or Fernet, an encryption key must be found somewhere in the environment. Encrypted nodes look for keys in the following order, favoring AES-GCM over Fernet:

If no encryption keys are found in the environment, envstack defaults to Base64 encoding:

$ envstack -eu
DEPLOY_ROOT=JHtST09UfS8ke0VOVn0=
ENV=cHJvZA==
ENVPATH=JHtERVBMT1lfUk9PVH0vZW52OiR7RU5WUEFUSH0=
HELLO=JHtIRUxMTzo9d29ybGR9
LOG_LEVEL=JHtMT0dfTEVWRUw6PUlORk99
PATH=JHtERVBMT1lfUk9PVH0vYmluOiR7UEFUSH0=
PYTHONPATH=JHtERVBMT1lfUk9PVH0vbGliL3B5dGhvbjoke1BZVEhPTlBBVEh9
ROOT=L21udC9waXBl
STACK=ZGVmYXVsdA==

Generating Keys

To use AES-GCM or Fernet encryption and serialize to an encrypted.env file, first generate and source keys in the shell using --keygen:

$ source <(envstack --keygen --export)

Once the keys are in the environment, you can encrypt the stack:

$ envstack -o secrets.env --encrypt

Encrypted variables resolve as long as the key is in the environment:

$ envstack secrets -r HELLO
HELLO=world

Storing Keys

Keys can be stored in other environment stacks, such as a keys.env file:

$ envstack --keygen -o keys.env

Then use keys.env to encrypt other environment files:

$ ./keys.env -- envstack -eo secrets.env

To decrypt, run the command inside the keys environment again:

$ ./keys.env -- envstack secrets -r HELLO
HELLO=world

Or add keys to the env stack:

$ envstack keys secrets -r HELLO
HELLO=world

Or automatically include keys:

include: [keys]

Variables automatically decrypt when resolved:

$ ./secrets.env -r HELLO
HELLO=world