Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support encryption of .env file #524

Open
skymoore opened this issue Jul 8, 2024 · 0 comments
Open

Support encryption of .env file #524

skymoore opened this issue Jul 8, 2024 · 0 comments

Comments

@skymoore
Copy link

skymoore commented Jul 8, 2024

Working in a high security environment it is sometimes concerning to have a .env file sitting on your machine with plaintext credentials needed for development. It is also cumbersome to regularly recreate the .env file per working session if the credentials are particularly sensitive. One possible solution would be to support pgp encryption of the .env file, so a call to load dotenv would look like:

from dotenv import load_dotenv

load_dotenv(encrypted=True)

Right now I'm using some boilerplate code like this:

from os import getenv
from io import StringIO
from gnupg import GPG
from dotenv import load_dotenv

# encrypted with `gpg -o .env.gpg -e --default-recipient-self .env`
with open("test.env.gpg", "rb") as f:
    env_vars = GPG().decrypt_file(f)

if not env_vars.ok:
    raise Exception(f"Decryption failed: {env_vars.status}")

load_dotenv(stream=StringIO(env_vars.data.decode()))

foo = getenv("FOO")
print(f"FOO: {foo}")

This way the decrypted credentials will only ever exist in memory and since I use a yubikey to store my private keys, there is no way to access that key and retrieve those credentials without the physical key.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant