e347e73976
- Updated file tracking to include `.dev.vars` alongside `.env` and `.env.*`. - Improved pre-commit hook to block plaintext secret files, including `.dev.vars`. - Added `clear` command to remove plaintext secret files from the current directory and workspaces. - Enhanced tests to cover new functionality for `.dev.vars` and the `clear` command. - Updated documentation to reflect changes in tracked files and command usage.
50 lines
1.4 KiB
Markdown
50 lines
1.4 KiB
Markdown
# secrets
|
|
|
|
Encrypted env file sync between machines using `age` key-file encryption + a private git repo.
|
|
|
|
## Quick Start
|
|
|
|
```bash
|
|
brew install age
|
|
./secrets init # Create ~/.secrets repo + generate age key
|
|
cd ~/my-project && ./secrets push # Encrypt .env* files, commit, push
|
|
# On other machine:
|
|
cd ~/my-project && ./secrets pull # Pull + decrypt .env* files
|
|
```
|
|
|
|
## Testing
|
|
|
|
```bash
|
|
brew install bats-core
|
|
bats test/secrets.bats
|
|
```
|
|
|
|
## Architecture
|
|
|
|
Single bash script (`secrets`) with subcommands: init, push, pull, list, rm, rekey.
|
|
|
|
- Encryption: `age` with key files (not passphrases — age passphrases are non-scriptable)
|
|
- Storage: Private git repo at `~/.secrets/`
|
|
- Convention: Tracks `.env`, `.env.*`, and `.dev.vars` (not `.envrc`, `.environment-*`)
|
|
- Workspaces: `--workspaces` flag reads `package.json` workspaces, requires `jq`
|
|
- Safety: Pre-commit hook rejects plaintext secret files
|
|
|
|
## Project Structure
|
|
|
|
```
|
|
secrets # CLI script (~300 lines bash)
|
|
hooks/pre-commit # Pre-commit hook template
|
|
test/
|
|
secrets.bats # bats-core test suite (25 tests)
|
|
test_helper.bash # Shared setup/teardown
|
|
README.md # User-facing documentation
|
|
CLAUDE.md # This file
|
|
```
|
|
|
|
## Key file
|
|
|
|
`~/.secrets/key.txt` is the age identity (private key). It is gitignored and must be copied manually to each machine once.
|
|
|
|
## Environment variable
|
|
|
|
`SECRETS_DIR` overrides the default `~/.secrets` location (useful for testing).
|