This is a CLI for easier use of vault
There is also a mina plugin mina-secrets
Add this line to your application's Gemfile:
And then execute:
Or install it yourself as:
$ gem install secrets_cli
The following environment variables need to be set:
VAULT_ADDR - address to your vault server (can also be set through config) VAULT_CACERT - if you have a self issued certificate, point this environment variable to the location of the root CA file
VAULT_AUTH_METHOD - this is auth method ('github', 'token', 'app_id' and 'approle' supported for now) VAULT_AUTH_TOKEN - this is vault auth token VAULT_AUTH_APP_ID - machine app_id (for app_id auth) VAULT_AUTH_USER_ID - machine user_id which matches app_id (for app_id auth) VAULT_AUTH_ROLE_id - machine role_id (for approle auth) VAULT_AUTH_SECRET_ID - machine secret_id which matches role_id (for approle auth)
For github token you only need
All commands have
--help with detailed descriptions of options.
Some of the commands have
--verbose switch which will print out the commands it run.
$ secrets init
This will create
.secrets file with project configuration. The command will ask you all it needs to know if you do not
supply the config through options.
Example of the
--- :secrets_file: config/application.yml # Required; file where your secrets are kept, depending on your environment gem (figaro, dotenv, etc) :secrets_storage_key: rails/my_project/ # Required; vault 'storage_key' where your secrets will be kept. development: # Any configuration can be nested under environment :vault_addr: https://myvault.com # Optional; vault url (default: VAULT_ADDR environment variable)
$ secrets policies
To get all the policies your auth grants please use this command.
$ secrets list
To get the list of all current environments please use this command.
storage_keys and environments
Next 3 commands read and write to your project storage_key in vault. The value of the storage_key is generated by secrets_storage_key + environment. Example:
development by default, but it can be overwriten by passing
--environment option, or setting
RAILS_ENV environment variable.
$ secrets read
This will read development secrets from the vault.
To read secrets from a different environment, use the
$ secrets read -e production
$ secrets edit
This will allow you to edit secrets on the fly. You choose which editor to use by defining an
$EDITOR variable, otherwise it will use one of these:
The same flags apply for editing as for reading:
$ EDITOR='atom -w' secrets edit -e production
$ secrets pull
This will pull from vault and write to your secrets file. The deafult file it will pull is the development one.
To pull from a different environment, also supply the
-e flag and the
-f flag for the file path:
$ secrets pull -e production -f config/application.production.yml
You can also supply the
-y flag to disable prompts and outputs.
$ secrets push
This will push from your secrets file to vault.
The same flags apply for pushing as for pulling:
$ secrets push -e production -f config/application.production.yml
After checking out the storage_key, run
bin/setup to install dependencies. Then, run
rake spec to run the tests. You can also run
bin/console for an interactive prompt that will allow you to experiment.
To install this gem onto your local machine, run
bundle exec rake install. To release a new version, update the version number in
version.rb, and then run
bundle exec rake release, which will create a git tag for the version, push git commits and tags, and push the
.gem file to rubygems.org.
Bug reports and pull requests are welcome on GitHub at https://github.com/infinum/secrets_cli. This project is intended to be a safe, welcoming space for collaboration, and contributors are expected to adhere to the Contributor Covenant code of conduct.
The gem is available as open source under the terms of the MIT License.