envkey / envkey-ruby

EnvKey's official Ruby client library

End-to-end encryption for app secrets. Superpowers for managing config.

• Protects API keys and other secrets.

• Live reload for environment variables.

• Fixes configuration sprawl and sloppy secrets management.

• Prevents config bugs and saves countless engineer-hours.

Easy integration

Check out the integration quickstart.

The cross-platform envkey-source tool works with any language and offers the most integration options.

Integrating with envkey-source is as easy as:

$ envkey-source -- any-shell-command
# That's it! Your command runs with the latest environment variables.

Language-specific wrappers are also available for:

• Node.js
• Python
• Go
• Ruby
• PHP

Why EnvKey?

• Open source, cross-platform, language-agnostic, end-to-end encrypted with NaCl.

• Set environment variables + manage apps, environments, branches, servers, people, devices, and access control all in one place.

• User-friendly UI + developer-friendly CLI.

• Easy integration wherever you need it.

• Cloud + self-hosting options.

• Version control, audit logs, re-usable blocks, branches, environment inheritance, customizable environments, local development environments, change hooks, device-based auth, OS keyring integration, and more.

Install

You can download the latest versions of the EnvKey UI and CLI for your platform by going to EnvKey's homepage and clicking the big Download button at the top of the page. Install it when it's finished downloading.

The first time you open the app, EnvKey's CLI and the envkey-source integration tool will also be installed for you. Both can also be installed individually on a server.

You can also go to releases in this repo and find the latest release of envkey-desktop for your platform.

Here's a quick overview on verifying releases with minisign.

Docs

Check out the docs, including a brief getting started overview.

Coming from v1?

Check out the v1 migration overview

Security

Read our security overview.

Status

See the current status of our services here.

Bugs

Please post an issue if you encounter a bug, even a small one. We'll do our best to fix it as soon as possible.

Discussion and Community

Jump in and ask a question, leave some feedback, ask for new features, or help out another EnvKey user.

Support

Email us: [email protected]

Paid plans include priority support.

License

All the code in this repo is free and open source under the MIT License.

EnvKey's Cloud and Business Self-Hosted products include commercially licensed server-side extensions for battle-ready infrastructure and advanced user management.

Contributing

Contributions to EnvKey are welcome! Please feel free to start a discussion to share your ideas, and/or open a PR.

Development

Here's an overview on setting up a dev environment to work on EnvKey.

envkey-ruby's Issues

Custom environments

Why can't I create additional environments, or at least rename existing ones? I don't need "staging" for example, but "CI".

envkey 1.2.0 causes infinite IPv6 loopback lookup when off network.

When upgrading to envkey 1.2.0 we noticed that our clients would hang if off network. This would also happen with certain VPN configurations. Reverting our application to use 1.1.0 resolved the issue.

Running:

$ strace -f -e trace=network -s 10000 rake -T

would eventually lead to the following:

[pid 19406] getpeername(6, <unfinished ...> [pid 19408] setsockopt(3, SOL_IPV6, IPV6_V6ONLY, [0], 4 <unfinished ...> [pid 19406] <... getpeername resumed> {sa_family=AF_INET6, sin6_port=htons(53), inet_pton(AF_INET6, "::1", &sin6_addr), sin6_flowinfo=htonl(0), sin6_scope_id=0}, [112->28]) = 0 [pid 19408] <... setsockopt resumed> ) = 0 [pid 19408] setsockopt(3, SOL_SOCKET, SO_BROADCAST, [1], 4) = 0 [pid 19408] connect(3, {sa_family=AF_INET6, sin6_port=htons(53), inet_pton(AF_INET6, "::1", &sin6_addr), sin6_flowinfo=htonl(0), sin6_scope_id=0}, 28) = 0 [pid 19408] getsockname(3, {sa_family=AF_INET6, sin6_port=htons(39363), inet_pton(AF_INET6, "::1", &sin6_addr), sin6_flowinfo=htonl(0), sin6_scope_id=0}, [112->28]) = 0 [pid 19408] getpeername(3, {sa_family=AF_INET6, sin6_port=htons(53), inet_pton(AF_INET6, "::1", &sin6_addr), sin6_flowinfo=htonl(0), sin6_scope_id=0}, [112->28]) = 0 [pid 19406] socket(AF_INET6, SOCK_DGRAM|SOCK_CLOEXEC|SOCK_NONBLOCK, IPPROTO_IP) = 3 [pid 19406] setsockopt(3, SOL_IPV6, IPV6_V6ONLY, [0], 4) = 0 [pid 19406] setsockopt(3, SOL_SOCKET, SO_BROADCAST, [1], 4) = 0 [pid 19406] connect(3, {sa_family=AF_INET6, sin6_port=htons(53), inet_pton(AF_INET6, "::1", &sin6_addr), sin6_flowinfo=htonl(0), sin6_scope_id=0}, 28) = 0 [pid 19406] getsockname(3, {sa_family=AF_INET6, sin6_port=htons(53694), inet_pton(AF_INET6, "::1", &sin6_addr), sin6_flowinfo=htonl(0), sin6_scope_id=0}, [112->28]) = 0 [pid 19406] getpeername(3, {sa_family=AF_INET6, sin6_port=htons(53), inet_pton(AF_INET6, "::1", &sin6_addr), sin6_flowinfo=htonl(0), sin6_scope_id=0}, [112->28]) = 0

Note at the end, it seems to be looking for the ::1 loopback. We've replicated this with MacOS and Ubuntu. Network on, no VPN, the code works reliably, but without network or on VPN, it will hang indefinitely.

Gem takes too much space

This gem takes way too much space, due to all the files in the ext folder.
I think this is unsustainable, and a different approach should be considered.

Store ENVKEY on server

Hi there,

I'm just setting up EnvKey for my Rails app.
For storing the ENVKEY on my production server, would a suitable approach be to create a .env file during deploy? Of course my local .env file is gitignored and contains the development ENVKEY, but since I have a custom deploy script (using Ansible), I could easily create a .env file on the server as well containing the production ENVKEY.
What would be the disadvantage to setting it as a proper environment variable on the server, if any?
Thanks! EnvKey is awesome! 😄

Secrets not updating on redeploy

Having an issue where my secrets are not being reloaded when deploying a new build of my application (Note: app is deployed in Cloud 66 in a Kubernetes container).

If I log into the new build and launch the Rails console it does return the new secret value, but the application still returns the first value ever assigned in the EnvKey app, regardless of how many times its been changed or the app has been deployed/launched.

Based on Issue #5 I changed my Gemfile to 1.2.6 but still the new deploy returns the original env variable value.

Gem load error (Ruby 2.6.7) on M1 Mac

When using gem envkey (resolving to 1.3.0) in my Gemfile, I get a Gem Load Error trying to run rails server (Rails 5.2.6, Ruby 2.6.7):

The envkey-specific logs are:

/Users/.../.rbenv/versions/2.6.7/lib/ruby/2.6.0/bundler/runtime.rb:84:in `rescue in block (2 levels) in require': There was an error while trying to load the gem 'envkey'. (Bundler::GemRequireError)
Gem Load Error is: As of 1.3.0, envkey-ruby only supports 64-bit systems. Please use an earlier version for 32-bit support.
Backtrace for gem load error is:
/Users/.../.rbenv/versions/2.6.7/lib/ruby/gems/2.6.0/gems/envkey-1.3.0/lib/envkey/platform.rb:45:in `arch_part'
/Users/.../.rbenv/versions/2.6.7/lib/ruby/gems/2.6.0/gems/envkey-1.3.0/lib/envkey/platform.rb:58:in `lib_file_dir'
/Users/.../.rbenv/versions/2.6.7/lib/ruby/gems/2.6.0/gems/envkey-1.3.0/lib/envkey/platform.rb:54:in `fetch_env_path'
/Users/.../.rbenv/versions/2.6.7/lib/ruby/gems/2.6.0/gems/envkey-1.3.0/lib/envkey/fetch.rb:6:in `fetch_env'
/Users/.../.rbenv/versions/2.6.7/lib/ruby/gems/2.6.0/gems/envkey-1.3.0/lib/envkey/core.rb:30:in `load_env'
/Users/.../.rbenv/versions/2.6.7/lib/ruby/gems/2.6.0/gems/envkey-1.3.0/lib/envkey.rb:4:in `<main>'

This appears to be because RbConfig::CONFIG['host_cpu'] is returning "aarch64" in this configuration, which is not matched in platform.rb:24. Changing that line to when /^arm|^aarch/ fixes the issue.

envkey does not update secrets in unicorn when reloaded with USR2

Basically the first time unicorn boots, envkey loads the env vars but does not keep track of which keys it set. Then on subsequent reloads with USR2 it fails to update the values because they are now already set and envkey will not override them.

Use git tags and create releases

Could you please tag each released version and create a release on GitHub?
This makes it easier to compare versions for example and keep up with the latest releases.
I use gem-release to automatically bump the version and push a release to Rubygems, but I don't think it creates a release on GitHub as well.