skarbiec env

Invocation#

skarbiec env import <dotenv-file> --prefix <id-prefix> [--bindings <file> [--replace]] [--tags <tag,...>] [--yes]

Purpose#

Move the secrets a project keeps in a .env file into the vault in one step, and keep the program reading them from its environment through exec, so the plain-text file can be deleted.

Required inputs and options#

• A .env file: NAME=value a line, an optional leading export, blank lines and # comments; a double-quoted value takes \n as a newline and a backslash before any other character as that character, a single-quoted one is taken as written, and an unquoted one ends before ` #`. --prefix starts every item id. --bindings names the bindings file to write, --replace writes it over an existing one, --tags tags every item, and --yes stores; relative paths are taken in the working directory.

Output and state effects#

• Without --yes, prints ok, applied false, source, bindings and items — each variable with its line, the item it would be stored as, <prefix>-<name in lower case with _ as ->, and its field token — and stores nothing. With --yes, stores each value as a token item named after its variable (if-absent, so nothing is replaced), writes the bindings file, NAME=<id>:token a line under a comment naming `skarbiec exec --env-from <file> -- <program>`, journals env-imported with the items and files but no value, and prints the same with applied true and next, saying the .env still holds every value in plain text. The operator API answers the same at POST /v1/operator/env-import with source and optional bindings as absolute paths, prefix, tags, replace and yes, on the machine it runs on only.

Refusals#

• No file or no --prefix exits 2 with the usage, and `env` with any other verb exits 2 naming `env import`. Refused naming the line, before anything is stored: a line that is not NAME=value, a comment or blank; a name that is not a variable name; a variable set twice; a quoted value that does not end on its line. Also refused before anything is stored: a file setting no variable, two variables stored as one id, an item id that already exists, and an existing bindings file without --replace. A store that fails part-way names the variable, its line and the items stored before it.

Examples#

skarbiec env import .env --prefix myapp --bindings .env.skarbiec --tags myapp skarbiec env import .env --prefix myapp --bindings .env.skarbiec --tags myapp --yes rm .env skarbiec exec --env-from .env.skarbiec -- npm start