Envite

One encrypted file

A vault is a single .envite file: XChaCha20-Poly1305 over a compressed database, with an authenticated header. Nothing is stored in the clear.

Built for teams

Every member opens the vault with their own password. Nobody shares a password, and removing a member rotates the vault key.

Local or over SSH

Keep the vault on your disk, a synced folder or a server reached with your own ssh setup. Concurrent edits merge on save.

Deploy .env files

Preview a key-by-key diff, confirm, and envite writes the .env file atomically, locally or on a server, with a backup of the previous one.

Terminal interface

A keyboard-driven TUI in a single static Linux binary, written in Rust. Works with NO_COLOR and the 16 colors of your terminal.

History and audit

Every project, environment, section and variable keeps its last 10 changes — who, when and which fields — without ever showing a value.

Quick install

Linux

curl -fsSL https://raw.githubusercontent.com/Kevinsillo/envite/main/install.sh | bash

A single static binary for Linux x86_64, checked against its SHA-256 and installed to ~/.local/bin. Options, manual download and updating → Installation.

How it works

Envite organizes environment variables in four levels:

• Projects — an application or service, with its descriptive fields.
• Environments — production, staging… each with its own deploy target.
• Sections — groups of variables, written as titled blocks in the .env file.
• Variables — a key, a value, an optional comment, a secret flag and a state.

The vault is the source of truth. When an environment is ready, envite renders its .env file, compares it with the one at the target and writes it there once you confirm.

Start with the introduction, or go straight to installation.