Keycli

An environment manager which stores your secrets in your OS keyring

Summary

keycli is designed to get rid of all your .env files, which store plaintext secrets on disk.

It enables you to store secrets in your OS keyring, manage per-project env vars, keep them in sync when variable requirements change, and load/unload the secrets into your environment.

For this tool to work properly, you need an already-working OS keyring like gnome-keyring or kwallet.

Install

From cargo

cargo install keycli

From the AUR

yay -S keycli

Aliases

Install keycli-load and keycli-unload shell functions to be able to get your env vars directly in your current shell

Zsh

keycli alias zsh >>~/.zshrc

Bash

keycli alias bash >>~/.bashrc

Completion

Zsh

keycli completion zsh >~/.zfunc/_keycli
keycli completion zsh keycli-load >~/.zfunc/_keycli-load
keycli completion zsh keycli-unload >~/.zfunc/_keycli-unload

Bash

keycli completion zsh >~/.zfunc/_keycli
keycli completion zsh keycli-load >~/.zfunc/_keycli-load
keycli completion zsh keycli-unload >~/.zfunc/_keycli-unload

Usage

$ keycli --helpA env manager which stores your secrets in your OS keyringUsage: keycli [OPTIONS] <COMMAND>Commands: load Print sourcable shell script to load secrets to the environment. Used by keycli-load unload Print sourcable shell script to unload secrets from the environment. Used by keycli-unload list List all env vars managed by keycli with the current options and args save Save secrets to the keyring clear Clear the keyring exec Execute a command with env vars shell Execute a shell with env vars init Create a .keycli.conf from secrets and / or a keycli.tpl alias Generate shell aliases completion Generate shell completion scripts help Print this message or the help of the given subcommand(s)Options: -v, --verbose Turn on verbose output [env: KEYCLI_VERBOSE=] -h, --help Print help -V, --version Print versionExamples:
# Create a .keycli.conf from a keycli.tpl and populate your keyringkeycli init
# Create a .keycli.conf from scratch and populate your keyringkeycli init -a my_app -s PASS -s PASS2 -s PASS3:another_app
# Run a shell with declared env varskeycli shell
# Load env varseval $(keycli load) # Or keycli-load if you installed the alias
# Unload env varseval $(keycli unload) # Or keycli-unload if you installed the alias
# Save vars without .keycli.conf filekeycli save -a custom_app -s ZOZO -s ZAZA
# Load vars without .keycli.conf filekeycli load -a custom_app -s ZOZO -s ZAZA
# Install completions and aliaseskeycli alias zsh >> ~/.zshrckeycli completion zsh > ~/.zfunc/_keyclikeycli completion zsh keycli-load > ~/.zfunc/_keycli-loadkeycli completion zsh keycli-unload > ~/.zfunc/_keycli-unload

Two files are important for keycli:

• keycli.tpl is a file meant to be commited and declares the environment variables needed for the project and a suggestion of their paths in the keyring
• .keycli.conf is a file to be kept local and declares the environment variables and paths in your keyring. It will be linked to a version of a keycli.tpl if generated with keycli init

.keycli.conf can be used without keycli.tpl. keycli.tpl is only here to suggest variables and keyring paths and to provide keycli a mechanism to alert the user if the project requirement changed in terms of environment variables.

Both files shares the same format: 1 secret per line in the form MY_ENV_VAR:my_app/my_secret_name. Lines starting with # are ignored.

Examples

Custom

keycli.tpl

PASS:app/pass
KEY:app/key

$ keycli init
The secret full path is: 'PASS:app/pass'? yes
Input the value of 'PASS:app/pass': [hidden]
INFO PASS was saved to keycli/app/pass
The secret full path is: 'KEY:app/key'? yes
Input the value of 'KEY:app/key': [hidden]
INFO KEY was saved to keycli/app/key
$ keycli exec --env | rg 'PASS|KEY'
KEY=zozo
PASS=zaza

Mise

mise.toml

[tools]
"cargo:keycli" = "latest"
[plugins]
keycli = "https://github.com/Headorteil/keycli-mise"
[env]
_.keycli = { tools = true }

Good to know

If an environment variable is defined multiple time, the last definition always takes precedence over others.

The variables defined with --extra-secrets take precedence over ones defined in the config file.