fnox import

• Usage: fnox import <FLAGS> [FORMAT]
• Aliases: im

Encrypt secrets from a dotenv, JSON, YAML, or TOML file into the config

Reads key/value pairs from --input (or stdin), encrypts each value with the encryption provider named by --provider, and writes the ciphertext to the config file in the current directory, or to the global config with --global. Keys that already exist keep their other settings, such as description and if_missing. Remote storage providers cannot be import targets.

fnox lists the keys and asks for confirmation before writing. When the data comes from stdin, pass --force (or --dry-run), because stdin cannot also answer the prompt.

Arguments

• [FORMAT] — Input format

  Choices: env, json, yaml, toml

  Default: env

Flags

• -f --force — Write without asking for confirmation
• -g --global — Write to the global config file (~/.config/fnox/config.toml)
• -i --input <INPUT> — File to read (default: stdin)
• -n --dry-run — List the keys that would be imported without writing anything
• -p --provider <PROVIDER> — Encryption provider to encrypt the values with
• --filter <FILTER> — Import only keys matching this regular expression
• --prefix <PREFIX> — Prepend this string to every imported key
• -h --help — Print help

Examples

Preview an import

fnox import -i .env -p age --dry-run

Import a dotenv file

fnox import -i .env -p age

Import only matching keys from JSON

fnox import json -i secrets.json -p age --filter '^STRIPE_'

Read from stdin

cat .env | fnox import -p age --force

See also

• Import and export