SecEnv CLI
#python#automation#microsaas
Di' addio ai costosi abbonamenti SaaS per la gestione dei segreti con SecEnv CLI. Un binario Go senza dipendenze con crittografia AES-GCM-256, prevenzione dei leak in pre-commit, rilevamento automatico del drift e sincronizzazione con un solo comando su AWS, GCP, Cloudflare e GitHub. Include binari multi-arch, configurazioni Docker e ricette di automazione CI/CD.
Leggi l'approfondimento tecnicoSecEnv CLI: Gestione dei Segreti Self-Hosted Senza la Tassa SaaSmain.pymain.py — estratto d'esempio nello stile del tool
#!/usr/bin/env python3
"""SecEnv CLI - Zero-dependency secret management and multi-cloud sync engine.
Ditch expensive secret SaaS subscriptions. SecEnv CLI provides end-to-end
encrypted environment variable management, pre-commit leak detection, and
automated sync to cloud providers and CI/CD platforms.
Features:
- AES-256-GCM authenticated local key-value vault encryption
- Pre-commit hook integration for zero-trust leak prevention
- Automated secret drift detection across local and remote providers
- One-command synchronization to AWS SSM, GCP Secret Manager, and GitHub
Usage:
$ secenv init [--path .env.enc]
$ secenv set DATABASE_URL="postgres://..." --stage prod
$ secenv sync --target aws-ssm --stage prod
"""
from dataclasses import dataclass, field
import enum
import hashlib
import json
import os
from pathlib import Path
from typing import Dict, List, Optional
class ProviderType(str, enum.Enum):
"""Supported cloud and CI/CD target providers."""
AWS_SSM = "aws-ssm"
GCP_SECRETS = "gcp-secrets"
CLOUDFLARE = "cloudflare"
GITHUB_ACTIONS = "github-actions"
@dataclass
class SecretEntry:
"""Encapsulates a managed secret and its integrity checksum."""
key: str
value: str
stage: str = "development"
checksum: str = field(init=False)
def __post_init__(self) -> None:
self.checksum = hashlib.sha256(self.value.encode()).hexdigest()
class SecEnvEngine:
"""Core manager for vault encryption, drift detection, and provider sync."""
def __init__(self, vault_path: Path, key: Optional[bytes] = None) -> None:
self.vault_path: Path = vault_path
self.key: bytes = key or os.urandom(32)
# ... the full file ships with your download