Show HN: EnvKey 2.0 – End-To-End Encrypted Environments (now open source)

Hey HN,

I'm so happy to finally show you all this release after years of hard work. I posted the first version of EnvKey to HN back in 2017 (https://news.ycombinator.com/item?id=15330757), then went through YC in W18 (https://news.ycombinator.com/item?id=16569534).

EnvKey is an end-to-end encrypted configuration and secrets manager. It protects your organization's API keys, encryption keys, credentials, and other secrets, and makes it easy to run servers, scripts, tests, and everything else with the latest config. It also helps you avoid duplication in your configuration, react to environment updates in real-time, resolve conflicts smoothly, and a lot more.

You get an intuitive, spreadsheet-like UI for managing environments, along with a developer-friendly CLI that does almost anything the UI can. Running any program in any language with the latest environment variables is as simple as:

  envkey-source -- any-shell-command

You can use the `es` alias to type less:

  es -- any-shell-command

You can automatically reload a process whenever there's a change using the -w flag:

  es -w -- ./start-server

To avoid downtime on reloads, add the --rolling flag to reload gradually across all connected processes:

  es -w --rolling -- ./start-server

You can run custom logic when there's a change instead of restarting:

  es -r ./reload-env.sh -- ./start-server

Or run something only when there's a change:

  es -r ./env-change-hook.sh

You can pass command line arguments from EnvKey variables (just wrap your command in single quotes):

  es 'curl https://$HOST_URL'

You can export your environment to the current shell:

  eval "$(es)"

Or auto-load the latest environment in any EnvKey-enabled directory (like direnv):

  echo $'\n\neval "$(es --hook bash)"\n' >> ~/.bash_profile

EnvKey is now open source under the MIT license and can be self-hosted. Our Cloud and Enterprise Self-Hosted products also include commercially licensed server-side extensions for auto-scaling, highly available infrastructure and advanced user management. Cloud is free for up to 20 user devices and 40 server keys.

EnvKey's client-side end-to-end encryption is built with the NaCl crypto library. Whether you use EnvKey Cloud or host EnvKey yourself, no configuration or secrets are ever sent to the host running EnvKey in plaintext. Public keys are verified by a web of trust. Invitations are verified out-of-band. Secrets are never accessed through a web browser. More details on security and encryption can be found here: https://docs-v2.envkey.com/docs/security

Let me know what you think! Thanks!

Show HN: EnvKey 2.0 – End-To-End Encrypted Environments (now open source)
v2.envkey.com

Looks interesting, is it a replacement for BitWarden too, or more focused on app environments (to set ENV vars)?

Yeah it's completely focused on app environments, so it's not a replacement for a password manager. That said, there's nothing stopping you from storing passwords in an EnvKey app and treating it as a very simple password manager. One benefit is that it would be very easy to manage your passwords programmatically in various ways if you had a need for that.

I have a few friends that run their own crypto nodes b/c they don't trust cloud providers (and their employees) to have access to their private keys (which may control millions of dollars).

Would this tool minimize the risk of an employee snapshots the disk and RAM of their machine?

Interesting! You show a lot of examples where the server is created as a child of your EnvKey process. That kind of suggests you might encounter EnvKey being the PID 1 in a containerized application. Does EnvKey have a good "PID 1 discipline" -- in particular, reaping zombie processes?