envctl

https://envctl.dev/docs
Admin
envctl is a distributed secrets management tool that uses peer-to-peer sync and cryptographic...
Tokens:2,386
Snippets:60
Trust Score:2.4
Update:6 months ago
Show doc for...
Tokens:
Raw
### Install envctl

Source: https://envctl.dev/docs

Installation commands for various operating systems.

```bash
curl -fsSL https://raw.githubusercontent.com/uradical/envctl/main/install.sh | sh
```

```powershell
irm https://raw.githubusercontent.com/uradical/envctl/main/install.ps1 | iex
```

```go
go install envctl.dev/go/envctl@latest
```

--------------------------------

### Interactive shell with secrets

Source: https://envctl.dev/docs

Starts a shell session with secrets loaded into memory, which are cleared upon exit.

```bash
$ envctl env shell -e staging
Passphrase:
Starting zsh with 5 secrets from myproject/staging
Type 'exit' to leave and clear secrets from memory.

$ echo $API_KEY
sk_live_...
$ exit

Exited envctl shell. Secrets cleared from memory.
```

--------------------------------

### Create Project

Source: https://envctl.dev/docs

Sets up envctl in the current directory.

```bash
$ envctl project create
```

--------------------------------

### Initialize and Manage Secrets via CLI

Source: https://envctl.dev/docs

Basic workflow for initializing identity, setting environment variables, and checking synchronization status.

```bash
$ envctl init
Generating identity...
✓ Fingerprint: sha256:7f3a...

$ envctl env var set API_KEY=sk_live_...
✓ Secret encrypted and signed

$ envctl status
✓ Synced with 2 peers
```

--------------------------------

### Initialize Identity

Source: https://envctl.dev/docs

Generates a keypair for project identity.

```bash
$ envctl init
```

--------------------------------

### Create Environment

Source: https://envctl.dev/docs

Adds a new environment to the project.

```bash
$ envctl env create qa
✓ Created environment 'qa'
```

--------------------------------

### List Environments

Source: https://envctl.dev/docs

Displays all environments and member access.

```bash
$ envctl env list
Environments for 'myproject':

* dev          (3 members) [default]
  staging      (2 members)
  prod         (1 member)
```

--------------------------------

### Enable relay for your project

Source: https://envctl.dev/docs

Configures a relay URL for the project, which is shared with teammates.

```bash
$ envctl project relay set relay.envctl.dev
```

--------------------------------

### Use Secrets

Source: https://envctl.dev/docs

Materializes a .env file or applies secrets directly to a command.

```bash
$ envctl env use prod
✓ .env written (2 secrets)
```

```bash
$ envctl env apply -- npm start
```

--------------------------------

### Invite Teammates

Source: https://envctl.dev/docs

Generates a join command for teammates to access the project.

```bash
$ envctl project invite alice@example.com
Share this with your teammate:
  envctl join abc123...
```

--------------------------------

### Switch environments

Source: https://envctl.dev/docs

Decrypts and writes secrets for the selected environment to your .env file.

```bash
$ envctl env use staging
✓ .env written (5 secrets)
```

--------------------------------

### Add Secrets

Source: https://envctl.dev/docs

Encrypts and adds a secret to the project.

```bash
$ envctl env var set API_KEY=sk_live_...
```

--------------------------------

### Generate a CI keypair

Source: https://envctl.dev/docs

Creates an ML-KEM-768 keypair for CI/CD operations. Store the private key securely in your CI platform.

```bash
$ envctl ci keygen
Generated CI keypair for project "myproject"

Public key stored on project chain (committed)

CI Private Key (store in your CI platform's secrets as ENVCTL_CI_KEY):

Kz4xN2U5...base64...

This private key will NOT be shown again.
Store it securely in your CI platform now.
```

--------------------------------

### Use in CI pipelines

Source: https://envctl.dev/docs

Decrypts and runs commands using the encrypted bundle and CI private key.

```yaml
# GitHub Actions example
- name: Run tests with secrets
  env:
    ENVCTL_CI_KEY: ${{ secrets.ENVCTL_CI_KEY }}
  run: envctl ci apply -b .envctl/prod.enc -- npm test
```

--------------------------------

### Run without .env file

Source: https://envctl.dev/docs

Injects secrets directly into the process environment without writing to disk.

```bash
$ envctl env apply -e prod -- ./deploy.sh
Passphrase:
✓ Running with 8 secrets
```

--------------------------------

### Local overrides

Source: https://envctl.dev/docs

Uses .env.<environment> files to override shared secrets with personal settings.

```bash
$ cat .env.dev
DATABASE_URL=postgres://localhost/mydb
DEBUG=true

$ envctl env use dev
✓ .env written (5 secrets)
Applied 2 override(s) from .env.dev
```

--------------------------------

### Check relay status

Source: https://envctl.dev/docs

Displays the current connection status of the relay daemon.

```bash
$ envctl project relay status
Relay Status for myproject

  URL: wss://relay.envctl.dev/ws
  Status: connected
```

--------------------------------

### Export encrypted bundle

Source: https://envctl.dev/docs

Exports secrets as an encrypted bundle for use in CI/CD pipelines.

```bash
$ envctl ci export -e prod -o .envctl/prod.enc
Identity passphrase:
Exported 8 variables to .envctl/prod.enc
```

--------------------------------

### Delete an environment

Source: https://envctl.dev/docs

Removes an environment. Use --force if members still have access.

```bash
$ envctl env delete old-env --force
✓ Deleted environment 'old-env'
```

--------------------------------

### Update secrets

Source: https://envctl.dev/docs

Updates a secret and re-exports the encrypted bundle for CI/CD.

```bash
$ envctl env var set -e prod NEW_API_KEY=sk_live_...
$ envctl ci export -e prod -o .envctl/prod.enc
$ git add .envctl/prod.enc && git commit -m "Update prod secrets"
```
Tokens:
Raw