Environments and values

New vaults start with empty development and production environments. Ordinary value commands operate on .ramenv.vault.toml in the current directory.

Create an environment

ramenv create-env staging

This creates a shared workspace encryption key and an empty staging environment in the current vault. Existing values and sibling service vaults stay unchanged. Repeating the command in a sibling service fails because the workspace key already exists.

Add or update values

ramenv set staging DATABASE_URL
ramenv set staging PORT --plaintext

Enter the value at the prompt; the command does not accept a value argument. Encryption is the default. --plaintext leaves the stored value readable in Git.

New variables receive required string validation rules. Customize the schema to match your application. Rules are shared across environments within the current vault.

Use uppercase names. run uppercases names during injection; differently cased names can collide when uppercased.

Import a dotenv file

Place the input at .env in the current directory:

ramenv onboard staging

Select which variables should be encrypted. Unselected values become plaintext. Imported keys overwrite matching keys in that environment.

Onboarding does not remove the source .env. Keep it out of Git, review imported plaintext, and remove the input yourself when it is no longer needed.

Inspect and compare

ramenv list staging
ramenv diff development staging

Values are masked by default; masks may expose portions of values. diff compares environments in the current vault, not separate service vaults.

To print complete decrypted values:

ramenv list staging --reveal
ramenv diff development staging --reveal

Do not put revealed values in shared logs or screenshots.

Delete a variable

ramenv delete staging DATABASE_URL

This removes the value from the selected environment. ramenv also removes its validation rule if no other environment in the current vault uses that key. Otherwise, it keeps the rule. If the rule requires the value, validation can then fail in the environment where you deleted it.

Rotate keys

ramenv rotate staging

Rotation changes the shared encryption key and re-encrypts encrypted values in every registered workspace vault containing that environment. Plaintext values are preserved. This is workspace-wide even when invoked from a service directory.

When multiple vaults are affected, ramenv asks for confirmation. To confirm without a prompt:

ramenv rotate staging --yes

Keep recovery material consistent with the vault versions you intend to restore. Old encrypted history requires its corresponding old keys.

Remove an environment

ramenv remove-env staging

This removes the environment’s data from affected registered vaults and deletes its shared encryption key. Multi-vault changes prompt for confirmation; --yes or -y confirms without a prompt.

Environment removal affects registered vaults across the workspace. Cloud deletion can remove the entire secret and all its key versions. Check the provider’s retention behavior before proceeding.

See the AWS, Azure, and Google guides for deletion details.