secrets-out v0.1.0
secrets-out
secrets-out is a command-line utility used to securely manage encrypted files and settings in your projects. It allows you to commit encrypted information into a repository such as git/github so that it remain alongside the project's code base while also helping to ensure that the original unencrypted information is not exposed.
Inspired by Rails' Encrypted Secrets and the sekrets gem.
Getting Started
Install
Requires Node.js and NPM
> npm install -g secrets-out
Incorporating into your Project
secrets-out relies upon your project's manifest (package.json) for configuration and must be executed from the same directory as your package.json file.
To add secrets-out to an existing application simply run the command secrets-install
and the utility will take care of the following:
- add a 'secrets-out' configuration file to
package.json
- create a
secrets.key
file to store your master encryption key locally - add
secrets.key
to your.gitignore
so that it is not commited to your repo (and potentially exposed)
After running secrets-install
we must set our master key in the secrets.key
file. If you would like to have a strong key generated for you, just run secrets-generate
and secrets-out will add a random 32-bit key to your key file.
Finally, we need to configure secrets-out to indentify the files that you would like to have encrypted. This can be easily accomplished by adding a list of files (by name or GLOB) to the files attribute as demonstrated below
"secrets-out": {
"files": [
"config/secrets.yml",
"config/*secrets.config",
"*secrets.config"
]
}
Encrypting Secrets
Once configured we can now encrypt our files. By running the command secrets-encrypt
, secrets-out will locate all files matching the configured files patterns and perform the following:
- Encrypt the file using node-cipher using the configured master key. Each file's encrypted counterpart shall have the same filename with a .enc extension added
- Check the project's .gitignore file and add the unencrypted source filename if not present. This shall ensure the source file is not committed to git/github. (existing projects may require steps to manually remove files that were previously committed to the repo)
Decrypting Secrets
Decrypting is just as simple. Run the command secrets-decrypt
and any matching files (.enc counterpart) shall be decrypted using the master key.
Master Key
secrets-out requires a master key to encrypt and decrypt files. This key can be provided to secrets-out using one of 3 different strategies
- A
secrets.key
file located in the project's root folder containing only the key (no line breaks or other characters). This is recommended for local development. - A command-line argument using the pattern
secrets-encrypt key=your_master_key_here
. This approach can be useful in transient environments such as build servers. - An environment variable as designated by the
key
attribute in your secrets-out configuration. For example, if we would like to use an environment variable namedSOME_MASTER_KEY
we simply update the project'spackage.json
to include the attribute"key": "SOME_MASTER_KEY"
and secrets-out will attempt to use this value to encrypt/decrypt.