ramenv
Docs Install

Open source · Rust native

Secrets, served
straight to RAM.

ramenv encrypts secrets at rest and injects them into a child process without writing plaintext files. Validate first when needed.

See how it works ↓
.ENVSEALEDRAM
KEYURISECRET
RAMprocess memory
Scroll to trace
01 / PREP TO PROCESS

From .env
to process memory.

ramenv run decrypts secrets
before starting your process.

LOCAL
.env
VAULTsealed
SERVED
01101100
RAM
API_KEY••••••
9/9VALID

IMPORT Choose what enters the vault.

ENCRYPT Each environment gets its own key.

VALIDATE Run an optional schema check.

RUN Load secrets into process memory.

01

Import your secrets

Choose which values to import from an existing .env file.

ramenv onboard development
02

Encrypt each environment

Development, staging, and production each use a separate key.

ramenv set production API_KEY
03

Validate before launch

Check types, ranges, patterns, and required values with a separate, optional command. ramenv run skips validation.

ramenv validate production
04

Load secrets into memory

ramenv decrypts values for the child process without creating a plaintext file.

ramenv run production -- npm start
WHAT RAMENV STORES

Keys stay out of Git.
Encrypted values stay in the vault.

LOCAL INGREDIENT / GITIGNORED.ramenv.keys

environment keys
vault signing keys

REPOSITORY / COMMIT
.ramenv.workspace.tomlworkspace metadata
.ramenv.vault.toml encrypted values + signed environment data
.ramenv.keyrefs.toml cloud ingredients only / key references, not raw keys

ramenv init adds .env and.ramenv.keys to .gitignore. Review any values stored with --plaintext before committing the vault.

02 / INGREDIENTS

Choose your
ingredient.

Choose where to store your workspace’s encryption and vault-signing keys: a local file or a cloud secret manager. In ramenv, this storage provider is called an ingredient.

Where ramenv
stores data.

KEY STORAGE
Local file Cloud secret manager
APPLICATION VALUES
.ramenv.vault.toml
AT LAUNCH
Fetch keys → decrypt → start your process

For cloud ingredients, .ramenv.keyrefs.toml records version-pinned key references. The file contains no raw keys or cloud credentials.

List ingredients with ramenv menu

Local

DEFAULT.ramenv.keys

Keep raw keys in a gitignored file at the workspace root. Back up and share this file securely.

ramenv init --ingredient local

No cloud account, login, or provider location required.

Local key guide

AWS

Secrets Manager

Store keys in AWS Secrets Manager. ramenv uses the AWS SDK’s default credential chain, including profiles, SSO, and workload roles.

ramenv init --ingredient aws

Authenticate with AWS, then enter your region during initialization.

AWS setup guide

Azure

Key Vault

Use an existing Azure Key Vault. Authentication options include developer-tool credentials, client secrets, managed identity, and workload identity.

ramenv init --ingredient azure

Authenticate with Azure, then enter your Key Vault URL during initialization.

Azure setup guide

Google Cloud

Secret Manager

Store keys in Google Cloud Secret Manager. ramenv authenticates with Application Default Credentials (ADC). A gcloud CLI login alone is insufficient.

ramenv init --ingredient google

Enable the Secret Manager API, then enter your project ID during initialization.

Google setup guide

Workspace configurationChoose an ingredient when you initialize the workspace. ramenv saves it in .ramenv.workspace.toml for runtime commands. Re-running init with another ingredient does not migrate an existing workspace.

Cloud accessGrant the required secret-store permissions and prefer workload identities for deployments. Follow your provider’s setup guide for authentication and access.

03 / ENVIRONMENT DIFF

Compare environments
before deploy.

LIVE COMPARISON ramenv diff development production MASKED BY DEFAULT
01

development

DATABASE_URL••••••••
API_KEY••••••••
PORT••••
LOG_LEVEL••••••••
1 uniqueMASKED
02

staging

DATABASE_URL••••••••
API_KEY••••••••
PORT••••
LOG_LEVEL••••••••
syncedMASKED
03

production

DATABASE_URL••••••••
API_KEY••••••••
PORT••••
LOG_LEVEL••••••••
2 changedMASKED
04 / OPTIONAL VALIDATION

Validate before
launch.

Run ramenv validate when you want a schema check. It catches bad types, out-of-range values, pattern mismatches, and missing required keys.

[validation.PORT]✓
type = "port"required = true
PORT 3000VALID
05 / MONOREPO WORKSPACES

One keyring.
Isolated vaults.

Share environment keys across services using your workspace’s ingredient. Each service keeps its own vault, validation rules, and vault-signing key.

WORKSPACE ROOT · LOCAL EXAMPLEworkspace/.ramenv.keys
3 isolated vaults
apps/api3 envs · 14 keysSEALED
apps/web3 envs · 8 keysSEALED
services/worker2 envs · 6 keysSEALED
PLAINTEXT .ENV
.env PLAINTEXT

DATABASE_URL=postgres://admin:password@…

API_KEY=sk-live-4f31ac98…

DEBUG=false

EXPOSED
SEALED BY RAMENV
.ramenv.vault.tomlENCRYPTED

API_KEY ="secret:FDRfxGTzJa…"

[metadata]

signature = "a91c3e…"

COMMIT READY
06 / INSTALL

Run your app with
encrypted secrets.

MIT LICENSENO RUNTIME DEPSONE SMALL BINARY