RAMENV / DOCUMENTATION
The ramenv manual
Install ramenv, choose where keys live, and run your application with encrypted environment variables.
On this page
ramenv is a Rust CLI for encrypted, version-controlled application configuration. Your values stay in a repository vault. Encryption and signing keys live locally or in your cloud secret manager.
At runtime, ramenv checks the vault’s integrity, decrypts values in memory, and passes them to a child process. It does not generate a decrypted .env file.
NEW TO RAMENV?
Follow the quickstart Start with a local vault.
Install the CLI, add a value, and run your app.
Start here
Key storage
IngredientsChoose where encryption and vault-signing keys are stored.Local keysProtect, share, and back up the default local key file.AWS Secrets ManagerConfigure AWS credentials, region, permissions, and version-pinned keys.Azure Key VaultSelect an Azure identity and grant access to an existing Key Vault.Google Cloud Secret ManagerConfigure ADC, enable the API, and grant access to pinned key versions.
Work with ramenv
Environments and valuesAdd, import, inspect, compare, rotate, and remove configuration.ValidationDefine required fields, types, bounds, and patterns in the vault schema.Workspaces and monoreposShare environment keys while keeping each service’s values and rules separate.Command referenceEvery CLI command, its scope, and the options that change its behavior.