dotsecenv

dotsecenv: safe environment secrets

A complete Go CLI application for securely managing environment secrets with GPG-based encryption, multi-user support, and FIPS 186-5 compliant algorithm defaults.

Quick Start

Store your first secret

# After installation (see below)
dotsecenv init config
dotsecenv init vault -v ~/.local/share/dotsecenv/vault
dotsecenv login <YOUR GPG FINGERPRINT> # gpg --list-public-keys
echo "xyz" | dotsecenv secret store TEST_SECRET
# Subsequently, you can decrypt secrets
# as long as you hold the corresponding secret key in GPG agent
dotsecenv secret get TEST_SECRET # should output "xyz"

Encryption defaults. Vaults use AES-256-GCM symmetric encryption (RFC 9580 / NIST SP 800-38D) wrapped in GPG multi-recipient asymmetric encryption. FIPS-compliant defaults are applied out of the box, with no extra flags at init time. To enforce specific algorithms across a team (or narrow them further), drop a policy.d/*.yaml fragment with approved_algorithms; see example 04.

Common tasks

Short, self-contained how-tos for the workflows beyond the quickstart:

• Append-only semantics: editing, audit, and rotation
• Migrate from a .env file
• Rotate a compromised GPG key
• Offboard a departing team member

Installation

Install Script (recommended)

The universal install script (install.sh) is the fastest way to install dotsecenv on macOS and Linux. It auto-detects your platform, downloads the correct binary, verifies checksums and GPG signatures, and installs shell completions, man pages, the shell plugin, and the Terraform credentials helper automatically.

Usage

# Piped (simplest)
curl -fsSL https://get.dotsecenv.com/install.sh | bash

# Piped with CLI flags
curl -fsSL https://get.dotsecenv.com/install.sh | bash -s -- [OPTIONS]

# Piped with environment variables
VERSION=v1.2.3 curl -fsSL https://get.dotsecenv.com/install.sh | bash

# Downloaded and run locally
curl -fsSL https://get.dotsecenv.com/install.sh -o install.sh
chmod +x install.sh
./install.sh --version v1.2.3

The script works with either curl or wget.

Options

Every setting can be configured via a CLI flag or an environment variable. Precedence order: CLI flags > environment variables > defaults.