Ask HN: How do you share and sync .env files and secrets with your team

Re:Ask HN: How do you share and sync .env files and secrets ... by martijnarts on Sunday September 08, 2024 @01:42PM (#41481823)

I've mostly used the 1Password CLI. A simple `op inject .env.template > .env` (off the top of my head) and done!

[ Parent | on HN ]

Re:Ask HN: How do you share and sync .env files and secrets ... by timwis on Sunday September 08, 2024 @02:39PM (#41482191)

But doesn’t that still write the secrets to disk? I thought the point of 1pass CLI was so you could avoid having unencrypted secrets on disk?

[ Parent | on HN ]

Re:Ask HN: How do you share and sync .env files and secrets ... by surething on Sunday September 08, 2024 @03:28PM (#41482530)

An alternative is using `direnv` and `.envrc` instead:

export TOKEN=$(op item get 'My Service' --fields label=token --vault workwork)

[ Parent | on HN ]

Re:Ask HN: How do you share and sync .env files and secrets ... by moltar on Sunday September 08, 2024 @03:51PM (#41482683)

Why not just use op run? It auto replaces references with values.

[ Parent | on HN ]

Re:Ask HN: How do you share and sync .env files and secrets ... by tomknig on Sunday September 08, 2024 @02:40PM (#41482194)

Also using 1Password and I think it’s great. If possible, I would suggest to avoid plaintext secrets in files though. Instead, it is possible to store references to secrets in a dotenv file (example: .env.development): DATABASE_URL=op://development/database/url

and use op run to inject the secrets into a subprocess instead of storing them in a file: op run --env-file="./.env.development" -- cargo run

[ Parent | on HN ]

Re:Ask HN: How do you share and sync .env files and secrets ... by martijnarts on Thursday September 12, 2024 @03:08PM (#41524382)

I love that, that's much better! Thanks!

[ Parent | on HN ]