Secrets & environment files

A secret is a set of KEY=VALUE pairs stored inside a vault. Everything is encrypted on your machine before it is sent, so the server stores ciphertext it cannot read.

The env commands move a secret between OneGuard and a file on disk. The secrets commands manage what is stored.

Environment commands

sync

The one you will use daily.

oneguard env sync

The first run in a directory asks which vault and which secret, and saves the answer in a local .oneguard file. Every run after that fetches the latest values straight into your .env.

sync --push

Reverses the direction: uploads your local .env into the linked secret.

oneguard env sync --push
oneguard env sync --push --path .env.staging

Both directions share the same link, so a directory is set up once and then pulls or pushes with no further arguments.

sync --reset

Forgets which secret this directory syncs to. Your .env on disk is left alone.

oneguard env sync --reset

resync

Clears the link and runs the selection again — for pointing a directory at a different secret.

oneguard env resync
oneguard env resync --push   # re-link, then upload

pull

A one-off fetch that does not link the directory.

oneguard env pull --id <secret> [--project <vault>] [--path <path>]

| Option | | | | --- | --- | --- | | --id | required | Secret id or 8-character prefix | | --project | optional | Vault id. Omitted, the CLI searches every vault in the organization | | --path | optional | Where to write. Defaults to .env, or the value set by secrets set-path |

Secret commands

list

oneguard secrets list --project <vault>

ID: 3cb0cce2 | Name: production | Archived: false

Names and archive state only — no command in the CLI prints a stored value to the terminal.

add

Create a secret from a single pair or from a whole file.

# from a single key/value
oneguard secrets add --project <vault> --name "production" \
  --key DB_PASSWORD --value supersecret

# from an existing .env
oneguard secrets add --project <vault> --name "production" --file .env.prod

| Option | | | | --- | --- | --- | | --project | required | Vault id | | -n, --name | required | Name for the secret | | -k, --key / -v, --value | | A single pair | | -f, --file | | Path to a .env file to upload |

edit

Replace a secret's stored contents.

oneguard secrets edit --project <vault> --id <secret> \
  --name "production" --file .env.prod

archive

Soft delete. The secret stops appearing in listings but is not removed.

oneguard secrets archive --project <vault> --id <secret>

delete

Permanent, and not undoable from the CLI.

oneguard secrets delete --project <vault> --id <secret>

set-path

Sets the default path env pull writes to when --path is omitted.

oneguard secrets set-path --path /path/to/.env