lcamilo15 · February 26, 2024 05:11 · Feb 1, 2020 · Jan 5, 2018
diff --git a/.env.DEV.enc b/.env.DEV.enc
@@ -0,0 +1 @@
+U2FsdGVkX18bL0goCbiTjHFGnkwWagZSYjhvkaU1hXA=
diff --git a/.env.PROD.enc b/.env.PROD.enc
@@ -0,0 +1 @@
+U2FsdGVkX19I2jmLcLYbddr8SGhfh3n/BuKY2uDmwis=
diff --git a/.env.TEST.enc b/.env.TEST.enc
@@ -0,0 +1 @@
+U2FsdGVkX19fH47Rl6T+HzlJiFK1ZJLXNN8sh87yN4A=
diff --git a/DEV-example.sh b/DEV-example.sh
@@ -0,0 +1,3 @@
+export ENVPASSWORD=ZuCmYE2qD6UU3C2Yh9BcB9Yin
+export ENV=DEV
+export $(openssl aes-256-cbc -d -a -in ./.env.$ENV.enc -pass env:ENVPASSWORD | xargs)
diff --git a/PROD-example.sh b/PROD-example.sh
@@ -0,0 +1,3 @@
+export ENVPASSWORD=ZuCmYE2qD6UU3C2Yh9BcB9Yin
+export ENV=PROD
+export $(openssl aes-256-cbc -d -a -in ./.env.$ENV.enc -pass env:ENVPASSWORD | xargs)
diff --git a/README.md b/README.md
@@ -0,0 +1,48 @@
+# OpenSSL Encrypted Environment Variables
+
+Both TravisCi, CodeShip, AWS, Docker Swarm and many professional platforms provide mechanisms to encrypt environment variables and pass them to the container. The key for the variables is stored in their key store mechanism. 
+
+However, if you wanted to use something universal, Good luck. I spent hours and couldn't find anything. If you find a solution please feel free to let me know, I would appreciate it. 
+
+I decided to use Open SSL with two variables. The variables are a Symmetric Encryption Key and Destination Environment value. These two variables are used to decrypt the correct env file and expand the variables into the shell. These two variables are sent to the container with the env files that are encrypted.
+
+As you can guess, this technique has problems ( as do all techniques ):
+
+* The key and destiny environment values are passed as clear text to the container ( but can be encrypted with the platforms techniques ).
+* The deployment has to decrypt the values and pass them to the shell... writing a file would be bad and this makes things complicated.
+* All the environment variables ( encrypted ) have to be bundled with the deployment. 
+
+## Layout and files
+
+files ```.env.<ENV>.enc``` were <ENV> is ``DEV``, ``PROD``, ``TEST`` are the encrypted environment files.
+
+files ```<ENV>-example.sh``` were <ENV> is ``DEV``, ``PROD``, ``TEST`` are test files and should be deleted.
+
+```
+.
+|____.env.DEV.enc
+|____.env.PROD.enc
+|____.env.TEST.enc
+|____TEST-example.sh
+|____DEV-example.sh
+|____PROD-example.sh
+```
+
+## The file that is encrypted looks like this....
+
+```
+export X=TEST
+```
+
+## Environment variables
+for this example. you need these two.
+
+I used the same key for all three environments ( bad idea ) ```ENVPASSWORD```
+
+```ENV``` tell this script which file to decrypt.
+
+```
+export ENVPASSWORD=ZuCmYE2qD6UU3C2Yh9BcB9Yin
+export ENV=TEST
+```
+- Phil
diff --git a/TEST-example.sh b/TEST-example.sh
@@ -0,0 +1,3 @@
+export ENVPASSWORD=ZuCmYE2qD6UU3C2Yh9BcB9Yin
+export ENV=TEST
+export $(openssl aes-256-cbc -d -a -in ./.env.$ENV.enc -pass env:ENVPASSWORD | xargs)
diff --git a/decrypt.sh b/decrypt.sh
@@ -0,0 +1,5 @@
+# Not a good idea to leave the decrypted file in the system. You might need to see it, this is how.
+openssl aes-256-cbc -d -a -in ./.env.DEV.enc -pass env:ENVPASSWORD -out ./.env
+
+
+export $(openssl aes-256-cbc -d -a -in ./.env.$ENV.enc -pass env:ENVPASSWORD | xargs) && echo $X
No results found