|
4 | 4 | [](LICENSE.md) |
5 | 5 | [](https://github.com/stechstudio/keep/actions/workflows/tests.yml) |
6 | 6 |
|
| 7 | +**Keep** is your toolkit for secure, collaborative management of application secrets across environments and teams. |
7 | 8 |
|
8 | | -**Keep** is your toolkit for collaborative, secure management of secrets across applications, environments, and teams. |
| 9 | +## Key Features |
9 | 10 |
|
10 | | -**Key Features:** |
11 | | -- **CLI Commands** - Manage individual secrets, import/export in bulk, view history and diffs, all via artisan commands |
12 | | -- **Multi-Vault Support** - Driver-based system, currently supporting AWS SSM Parameter Store and AWS Secrets Manager |
13 | | -- **Environment Isolation** - Separate secrets by environment (local, staging, production) with access controls |
14 | | -- **Unified Export System** - Direct export, template processing, and encrypted caching all in one command |
15 | | -- **Template System** - Replace placeholders in templates with vault secrets while preserving formatting |
16 | | -- **Team Collaboration** - Share secret management across team members with proper access controls |
17 | | -- **CI/CD Integration** - Export secrets for deployment pipelines and automated workflows |
| 11 | +- **🔐 Multi-Vault Support** - AWS SSM Parameter Store and AWS Secrets Manager |
| 12 | +- **🚀 Interactive Shell** - Context-aware shell with tab completion for rapid secret management |
| 13 | +- **🌍 Environment Isolation** - Separate secrets by stage (local, staging, production) |
| 14 | +- **📝 Template System** - Merge secrets into templates while preserving structure |
| 15 | +- **🔄 Bulk Operations** - Import, export, copy, and diff secrets across environments |
| 16 | +- **🤝 Team Collaboration** - Share secret management with proper access controls |
| 17 | +- **⚙️ CI/CD Ready** - Export secrets for deployment pipelines |
18 | 18 |
|
19 | | -The package provides a secure, organized way to manage application secrets without storing them in version control or sharing them insecurely. |
20 | | - |
21 | | -## Quick Start |
22 | | - |
23 | | -### Install and configure Keep |
24 | | - |
25 | | -Install the package via composer: |
| 19 | +## Quick Example |
26 | 20 |
|
27 | 21 | ```bash |
| 22 | +# Install |
28 | 23 | composer require stechstudio/keep |
29 | | -``` |
30 | | - |
31 | | -This will install a command in your `vendor/bin` directory called `keep`. Run `keep configure` to configure Keep and your first vault. |
32 | 24 |
|
33 | | -```bash |
| 25 | +# Configure |
34 | 26 | ./vendor/bin/keep configure |
35 | | -``` |
36 | | - |
37 | | -You should now have Keep configured with a default vault. Run `keep verify` to check your setup and ensure you have necessary permissions. |
38 | 27 |
|
39 | | -```bash |
40 | | -./vendor/bin/keep verify |
41 | | -``` |
| 28 | +# Interactive shell - the fastest way to work |
| 29 | +./vendor/bin/keep shell |
42 | 30 |
|
43 | | -### Manage secrets |
44 | | - |
45 | | -You can add secrets using `keep set`: |
46 | | - |
47 | | -```bash |
48 | | -# You will be prompted for the stage and secret value |
49 | | -./vendor/bin/keep set DB_PASSWORD |
50 | | - |
51 | | -# Or specify the stage and value directly |
52 | | -./vendor/bin/keep set DB_PASSWORD --stage=production --value="supersecretpassword" |
53 | | -``` |
54 | | - |
55 | | -This will store the `DB_PASSWORD` secret in AWS SSM under the path `/[namespace]/production/DB_PASSWORD`. |
56 | | - |
57 | | -Check that the secret was added: |
58 | | - |
59 | | -```bash |
60 | | -# Retrieve a single secret |
61 | | -./vendor/bin/keep get DB_PASSWORD --stage=production |
| 31 | +# Set a secret |
| 32 | +./vendor/bin/keep set DB_PASSWORD "secret" --stage=production |
62 | 33 |
|
63 | | -# List all secrets for production |
64 | | -./vendor/bin/keep list --stage=production |
65 | | -``` |
66 | | - |
67 | | -### Using secrets in your application |
68 | | - |
69 | | -#### Direct Export - Generate complete `.env` file from secrets |
70 | | - |
71 | | -If all your environment variables are managed via Keep, export them directly to a .env file: |
72 | | - |
73 | | -```bash |
74 | | -# Export all secrets from all vaults |
| 34 | +# Export to .env |
75 | 35 | ./vendor/bin/keep export --stage=production --file=.env |
76 | 36 |
|
77 | | -# Export from specific vaults only |
78 | | -./vendor/bin/keep export --stage=production --vault=ssm,secrets --file=.env |
79 | | - |
80 | | -# Export as JSON format |
81 | | -./vendor/bin/keep export --stage=production --format=json --file=config.json |
| 37 | +# Use template with placeholders |
| 38 | +./vendor/bin/keep export --stage=production --template=.env.template --file=.env |
82 | 39 | ``` |
83 | 40 |
|
84 | | -#### Template Mode - Merge secrets into a template file |
85 | | - |
86 | | -Use a template file with placeholders for sensitive values: |
| 41 | +## Interactive Shell |
87 | 42 |
|
88 | | -Example `.env.template`: |
| 43 | +The Keep shell provides a context-aware environment for managing secrets: |
89 | 44 |
|
90 | | -```env |
91 | | -# Application Config |
92 | | -APP_NAME=MyApp |
93 | | -APP_ENV=production |
94 | | -
|
95 | | -# Database - sensitive values from vaults |
96 | | -DB_HOST={aws-ssm:database/host} |
97 | | -DB_PORT=3306 # Static value |
98 | | -DB_PASSWORD={aws-secrets:db-password} |
| 45 | +```bash |
| 46 | +$ ./vendor/bin/keep shell |
| 47 | +Welcome to Keep Shell v1.0.0 |
99 | 48 |
|
100 | | -# API Keys |
101 | | -API_KEY={vault1:api/key} |
102 | | -``` |
| 49 | +ssm:local> use production |
| 50 | +Switched to: ssm:production |
103 | 51 |
|
104 | | -Then process the template: |
| 52 | +ssm:production> set API_KEY |
| 53 | +Value: ******** |
105 | 54 |
|
106 | | -```bash |
107 | | -# Replace placeholders with actual secrets |
108 | | -./vendor/bin/keep export --stage=production --template=.env.template --file=.env |
| 55 | +ssm:production> copy API_KEY staging |
| 56 | +✓ Copied API_KEY to staging |
109 | 57 |
|
110 | | -# Include ALL vault secrets (template + additional) |
111 | | -./vendor/bin/keep export --stage=production --template=.env.template --all --file=.env |
112 | | - |
113 | | -# Handle missing secrets gracefully |
114 | | -./vendor/bin/keep export --stage=production --template=.env.template --missing=blank --file=.env |
| 58 | +ssm:production> diff staging production |
| 59 | +│ Key │ staging │ production │ Status │ |
| 60 | +├─────────┼─────────┼────────────┼────────┤ |
| 61 | +│ API_KEY │ abc... │ abc... │ ✓ │ |
115 | 62 | ``` |
116 | 63 |
|
117 | | -#### Encrypted Cache - For Laravel Integration |
118 | | - |
119 | | -Export secrets to an encrypted cache for use with Laravel's config caching: |
| 64 | +## Documentation |
120 | 65 |
|
121 | | -```bash |
122 | | -./vendor/bin/keep export --stage=production --cache |
123 | | -``` |
| 66 | +📚 **Full documentation available at [https://stechstudio.github.io/keep/](https://stechstudio.github.io/keep/)** |
124 | 67 |
|
125 | | -This creates an encrypted cache file in `.keep/cache/` and adds the decryption key to your `.env` file. |
| 68 | +- [Installation & Configuration](https://stechstudio.github.io/keep/guide/installation) |
| 69 | +- [Managing Secrets](https://stechstudio.github.io/keep/guide/managing-secrets/) |
| 70 | +- [Interactive Shell Guide](https://stechstudio.github.io/keep/guide/shell) |
| 71 | +- [AWS Authentication](https://stechstudio.github.io/keep/guide/reference/aws-authentication) |
| 72 | +- [CLI Reference](https://stechstudio.github.io/keep/guide/reference/cli-reference) |
126 | 73 |
|
127 | 74 | ## License |
128 | 75 |
|
129 | | -The MIT License (MIT). Please see [License File](LICENSE.md) for more information. |
| 76 | +The MIT License (MIT). Please see [License File](LICENSE.md) for more information. |
0 commit comments