Env Manager

The problem

Secrets travel by chat, sit in .env files on laptops and are duplicated in GitLab’s CI variables. Nobody reliably knows which values are currently valid, who last saw them, or what would have to be rotated when someone leaves. The usual secret managers solve that, but their server can read every value. That only moves the trust problem.

How it solves it

Env Manager arranges secrets into workspaces, projects and environments. Encryption and decryption happen exclusively on the client, in the browser through libsodium-wasm and in the CLI through RbNaCl. The server receives ciphertext and metadata. It can decrypt nothing, because it holds nothing it could decrypt with.

No password, no private key and no plaintext value reaches the server, and that is a property of the construction, not an operating rule.

What it does

A CLI without Rails. envm is a Thor gem with RbNaCl and the standard library. Its token lives in the operating system keychain. The .envm.yml file contains only slugs for workspace, project and environment, which is why it may be committed. In a fresh worktree, envm pull is enough.

Injecting without writing a file. envm run -- hands the values straight into the process. Nothing is left lying on disk.

GitLab bindings belong to the server. Which GitLab project belongs to which environment is decided and verified by the server, not by the calling client. A locally managed project therefore cannot slip in a foreign project id. The binding is final, and a revocation is logged.

Every change is a transaction. Validate, authorise, execute: as a Dry::Transaction with cascading steps. The controller only translates the result into an HTTP status. Every response under /api is a Problem Details document per RFC 9457, from a single source.

Roles and protected environments. A ladder from Guest to Owner applies per workspace and per project, and the stronger one wins. Protected environments require Maintainer at minimum, reading included. Every reveal and every export of secret material writes an audit row; the values themselves appear neither in the log nor in the audit metadata.

What it does not do

It cannot restore a lost key. That is the price of a server that can decrypt nothing, and it is not negotiable.

It runs as an internal production system for ourselves today. There are no external users and no self-service registration.

It does not rotate secrets itself and talks to GitLab only. Other CI systems are not connected.