veritas

Encrypted environment variables for node done right.

Install

npm install -g veritas-env

Configure

Veritas supports the following options via environment variables

Required

• VERITAS_SECRET: The secret used to encrypt each environment variable.
• VERITAS_SALT The salt to use during encryption.

Optional

• VERITAS_ENCRYPTION_ALGORITHM: Encryption algorithm to use. Default: aes256
• VERITAS_SALT_KEY_LENGTH: Salt length (bytes). This must match the requirements of the selected encryption algorithm. Default: 32
• VERITAS_IV: User provided Initialization Vector string. See below.
• VERITAS_IV_LENGTH: Initialization Vector length (bytes). Default: 16

By default, a random Initialization Vector is used each time a variable is encrypted. While technically more secure, it has the down side of changing all the values in the output JSON file each time they are encrypted, meaning that if you update just one variable, a git diff will show all variables as being changed. You can change this behavior by providing your own IV via VERITAS_IV.

Usage

To encrypt an existing .env file

$ npx veritas-env encrypt --input=.env --output=./path/to/encrypted.json

To decrypt an existing file encrypted by veritas

$ npx veritas-env decrypt --input=./path/to/encrypted.json --output=.env

Tip: Use something like direnv to automatically expose your secrets when running the above commands.

Motivation

• Diffs

  The problem similar libaries have is that they encrypt the entire contents of a file, making it opaque to diffing. It can be quite a cumbersome process to merge changes from another branch that updates an encrypted file that your branch has also modified. Multiple this by the number of environments you have, and ... I feel your pain.

• Vercel

  While I love Vercel and use it for numerous projects, it has the unfortunate limit of only allowing a total of 4KB for environment variables. Use something like a credentials JSON file to work with Google libraries, and you've pretty much blown your entire budget.

  Here's how you can configure your next.config.js to work with Veritas.

  const { decrypt } = require('veritas-env')
  
  const env = decrypt(`./config/${process.env.ENV_FILE}.json`, '.env')
  
  module.exports = { env }

  Then configure your secrets and ENV_FILE in Vercel's envrionment variables for the Preview and Production environments and you're all set. Damn that wasy easy!