secrets

Sync .env files between machines without storing them in git. Encrypts with age, stores in a private repo.

Install

brew install age
# Clone this repo or copy the `secrets` script to your PATH

Usage

secrets init              # Create ~/.secrets repo + generate age key
secrets push [project]    # Encrypt .env* files and push
secrets pull [project]    # Pull and decrypt .env* files into current dir
secrets list              # Show all projects
secrets rm <project>      # Remove a project's secrets
secrets rekey             # Re-encrypt everything with a new key

If [project] is omitted, it's derived from the current directory's git remote or name.

How it works

Your project dir          ~/.secrets/ (private git repo)        GitHub (private)
┌──────────────┐         ┌────────────────────┐               ┌──────────┐
│ .env.staging │──age──▶ │ proj/.env.staging   │──git push──▶ │ encrypted│
│ .env.prod    │ encrypt │        .age         │              │  .age    │
└──────────────┘         │ key.txt (gitignored)│              │  files   │
                         └────────────────────┘               └──────────┘

1. secrets init generates an age key pair at ~/.secrets/key.txt
2. secrets push encrypts .env and .env.* files, commits to the secrets repo, pushes
3. On your other machine: secrets pull fetches and decrypts into the current directory

The key file must be copied to each machine once (AirDrop, scp, USB).

Safety

• A pre-commit hook in ~/.secrets/ rejects any plaintext .env file
• .gitignore blocks key.txt and plaintext env files from being committed
• Only .env and .env.* files are matched (not .envrc, .environment-*, etc.)

Testing

brew install bats-core
bats test/secrets.bats    # 20 tests