Envoy

Envoy is a secure, Git-like command-line tool for managing encrypted environment files across machines and teams.

Environment files are essential to modern software projects, but they are difficult to synchronize safely. They cannot be committed to Git, copying them manually is error-prone, and many hosted secret-management solutions require trusting a remote service with plaintext values or encryption keys.

Envoy treats environment files as encrypted, versioned artifacts. It provides a familiar workflow based on initialization, staging, commits, remotes, pushes, pulls, diffs, and history—while keeping cryptographic control on the user's machine.

Core Workflow

envy init
envy add
envy commit -m "Add production secrets"
envy push
envy pull
envy status
envy diff

The CLI stores local project state inside a .envoy/ directory, including the current HEAD, remote references, encrypted content-addressed objects, and local cache data.

Managed files can be:

• Added and encrypted locally
• Committed into a versioned history
• Pushed to a remote Envoy project
• Pulled and restored on another machine
• Compared through redacted diffs
• Removed while protecting locally modified files
• Restricted to selected project members

Envoy also supports non-interactive input through command arguments and newline-delimited key=value records, making it suitable for CI pipelines, scripts, and AI-agent workflows.

Security Model

Envoy follows a zero-knowledge design. Plaintext environment variables and encryption keys never leave the client.

The server stores encrypted blobs, commit history, membership information, and access metadata, but cannot decrypt the managed files. The cryptographic design uses:

• Argon2id for memory-hard project key derivation
• HKDF-SHA-256 for deriving independent keys for managed files
• XChaCha20-Poly1305 for authenticated encryption
• SHA-256 for content addressing and integrity verification
• Random salts and nonces to ensure repeated encryptions produce unrelated ciphertext

Each managed file receives its own derived encryption key. Commits contain encrypted manifests that describe the project state, while encrypted file contents are stored as content-addressed blobs.

This allows Envoy to provide version history and synchronization without turning the remote service into a repository of plaintext secrets.

Authentication and Collaboration

The CLI authenticates through GitHub OAuth using the device flow, which is well suited to command-line environments where a traditional browser callback is inconvenient.

Projects can have multiple members, and access can be restricted on a per-file basis:

envy member list
envy access grant .env.production USER_ID
envy access revoke .env.production USER_ID
envy access list .env.production

The owner publishes access changes through the normal commit and push workflow, keeping permissions associated with the project's versioned state.

Rust CLI

The command-line client is written in Rust and compiled as the envy executable. Rust provides strong compile-time guarantees around file handling, ownership, error propagation, and security-sensitive data flows.

The CLI is distributed through:

• Cargo and crates.io
• Prebuilt release binaries
• macOS and Linux installation scripts
• A Windows PowerShell installer
• Cross-platform GitHub Actions builds

The project also maintains versioned API-contract fixtures shared with the Envoy web service, helping keep the Rust client and backend behavior aligned as the system evolves.

Backend and Storage

The Envoy service is hosted at envoy.denizlg24.com and provides authentication, project management, membership, commit metadata, and encrypted blob storage.

The backend uses a lightweight Hono API with a database layer and object storage. Since encryption happens entirely on the client, the server remains deliberately simple: it authenticates users, validates permissions, stores encrypted objects, and coordinates synchronization.

This separation reduces the server's access to sensitive information and keeps the most important security boundary inside the client.

What I Built

Envoy combines several areas of engineering in one project:

• A Git-inspired object and commit model
• Client-side encryption and key derivation
• Secure local file and cache management
• Redacted secret diffs
• Remote synchronization and conflict-aware workflows
• GitHub device-flow authentication
• Per-file access control
• Non-interactive automation support
• Cross-platform Rust release builds
• A web service for encrypted project storage

Envoy is designed for developers who want the convenience of version-controlled environment files without treating secrets like ordinary source code or handing plaintext credentials to a third-party service.