You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Adonis Credentials is created to help manage multiple environment secrets, share them securely and even keep them inside your repo.
26
+
AdonisJS Credentials is created to help you manage multiple environment secrets, share them securely and even keep them inside your repo.
27
+
28
+
Inspired by Rails Credentials.
30
29
31
30
## Installation
32
31
33
32
To install the provider run:
34
33
35
34
```bash
36
-
npm install @bitkidd/adonis-credentials
35
+
npm install @bitkidd/adonisjs-credentials
37
36
# or
38
-
yarn add @bitkidd/adonis-credentials
37
+
yarn add @bitkidd/adonisjs-credentials
39
38
```
40
39
41
40
## Configuration
@@ -45,56 +44,42 @@ To configure credentials provider, we should proceed with 4 steps:
45
44
#### Run `ace configure`
46
45
47
46
```
48
-
node ace configure @bitkidd/adonis-credentials
47
+
node ace configure @bitkidd/adonisjs-credentials
49
48
```
50
49
51
-
This will add two new commands to your app and will allow to create and edit credentials.
52
-
At the same time it will add a new rule to your `.gitignore` file that will exclude all `*.key` files from repository and will not allow to commit them.
53
-
54
-
#### Modify `server.ts` file
50
+
This will:
55
51
56
-
As a next step you need to modify the `server.ts` file and add a new line inside it, just before the `Ignitor`:
52
+
- Add two new commands to your app and will allow to create and edit credentials
53
+
- Add a new rule to your `.gitignore` file that will exclude all `*.key` files from repository and will not allow to commit them
54
+
- Add a new `credentials.ts` file inside `/start` folder
57
55
58
-
```ts
59
-
// This goes on top, where import declarations are
awaitimport('#start/credentials') // <--- Import credentials here
65
+
})
66
+
...
66
67
```
67
68
68
-
This allows the credentials to be parsed and populated inside current `process.env` before the app even starts, so an `Env` provider will be able to validate values.
69
-
70
-
#### Modify `.adonisrs.json`
71
-
72
-
As a final step, open `.adonisrc.json` file and add `resources/credentials` to `metaFiles` section, so credentials will copied as you build your Adonis app.
73
-
74
-
#### Modify `ace` file (optional)
75
-
76
-
In this step you do basically the same thing as done in a step above, but for `ace` commands that need the app to be loaded, just add two new lines to the file.
69
+
#### Modify `bin/console.ts` file
77
70
78
-
```js
79
-
// ...
80
-
// This goes on top, where require declarations are
awaitimport('#start/credentials') // <--- Import credentials here
78
+
})
79
+
...
87
80
```
88
81
89
-
This will populates credentials into the ace process so they will be available in it.
90
-
91
-
#### Pipe credentials to command (optional)
92
-
93
-
Another way to make credentials visible to command, is to run that command inside a child process with secret credentials populated, for example:
94
-
95
-
`node ace credentials:pipe 'ace migrations:run'`
96
-
97
-
This reads credentials, decrypts them, creates a child process and populates environment with some new values from your vault and then runs the command that you specified.
82
+
This will allow commands and app that they will start get access to credentials.
98
83
99
84
## Usage
100
85
@@ -107,7 +92,6 @@ As you configured the provider, you may now create your first credentials by run
107
92
# ---
108
93
# Flags
109
94
# --env string Specify an environment for credentials file (default: development)
110
-
# --format string Specify format for the credentials file (default: yaml, available: json,yaml)
111
95
112
96
node ace credentials:create
113
97
```
@@ -116,10 +100,10 @@ This will create a new directory in your `resources` folder, called `credentials
116
100
117
101
Obviously, the `.key` file keeps your password to the credentials file, **do not commit any .key files to your git repo**, please check your `.gitignore` for `*.key` exclusion rule.
118
102
119
-
The `.key` should be kept somewhere in a secret place, the best spot I know is a sticky note on your laptop. Just NO, don't do this :see_no_evil:
103
+
`.key` should be kept somewhere in a secret place, the best spot I know is a sticky note on your laptop. Just NO, don't do this :see_no_evil:
120
104
Keep your secrets in a secure place and use password managers!
121
105
122
-
The `.credentials` file can be committed and shared as it is impossimple to decrypt it without the password.
106
+
`.credentials` file can be committed and shared as it is impossible to decrypt without the key.
123
107
124
108
These two files should always be kept in one folder while in development.
This will decrypt the credentials file, create a temporary one and open it in the editor you specified. As you finish editing, close the file (or tab inside your editor), this will encrypt it back again and remove the temporary file, to keep you safe and sound.
143
-
144
-
#### Piping credentials
145
-
146
-
To pipe credentials to a command that needs them run:
147
-
148
-
```bash
149
-
# node ace credentials:pipe <command>
150
-
# ---
151
-
# Args
152
-
# command Specify an ace command to pipe credentials to
153
-
# Flags
154
-
# --env string Specify an environment for credentials file (default: development)
126
+
You can also add `EDITOR='code --wait'` to your `.env` file to omit `--editor` flag.
This will decrypt the credentials file, create a temporary one and open it in the editor you specified. As you finish editing, close the file (or tab inside your editor), this will encrypt it back again and remove the temporary file, to keep you safe and sound.
160
129
161
130
#### Using in production
162
131
@@ -170,20 +139,7 @@ For production you should set additional environment variable `APP_CREDENTIALS_K
170
139
171
140
The provider uses node.js' native crypto library and encrypts everything using _AES_ cipher with a random vector, which makes your secrets very secure, with a single key that can decrypt data.
172
141
173
-
Credentials while decrypted present themselves as simple files in JSON or YAML formats, this allows to keep variables in a very predictable and simple manner:
174
-
175
-
**JSON**
176
-
177
-
```json
178
-
{
179
-
"google": {
180
-
"key": "your_google_key",
181
-
"secret": "your_google_secret"
182
-
}
183
-
}
184
-
```
185
-
186
-
**YAML**
142
+
Credentials while decrypted present themselves as simple files in YAML format, this allows you to keep variables in a very predictable and simple form:
187
143
188
144
```yaml
189
145
google:
@@ -198,8 +154,6 @@ GOOGLE_KEY=your_google_key
198
154
GOOGLE_SECRET=your_google_secret
199
155
```
200
156
201
-
And then populated to `process.env`, as this is done before Adonis.js `Env` provider, you may even validate data to be sure that everything is present and has an exact format.
0 commit comments