Manage Rails secrets and ENV without .env files

Rails has encrypted credentials for secrets that ship with the app, and ENV for everything that differs per machine or environment, often loaded from .env by dotenv-rails. dotsafe takes over the ENV side: variables stay encrypted on your Mac and are set when Rails starts.

Move your .env into dotsafe

dotsafe import                                 # ./.env into the development environmentrm .env

Run Rails with your variables

dotsafe run -- bin/rails serverdotsafe run -- bin/dev                          # Procfile.dev: web, jobs and assets togetherdotsafe run -- bin/rails test

ENV.fetch("STRIPE_SECRET_KEY") and database.yml's <%= ENV["DATABASE_URL"] %> work as before.

Keep the master key safe too

RAILS_MASTER_KEY unlocks your encrypted credentials. Store it in dotsafe instead of config/master.key on every machine:

dotsafe set -e production RAILS_MASTER_KEY     # asks for the valuedotsafe run -e production -- bin/rails console

Rotate keys in one place

If several apps use the same Stripe or OpenAI key, make it a shared secret and rotate it once:

dotsafe secret share STRIPE_SECRET_KEY --alldotsafe secret rotate STRIPE_SECRET_KEY

Start with the quick start.