explewd/keep
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

keep pull: fill saved template with real values by default
All checks were successful
Docker / build-and-push (push) Successful in 1m54s
Details

Browse Source 
A bare key/value dump throws away the comments/structure a template
preserves; now a plain pull reconstitutes the real .env from the
template when the vault has one, falling back to the flat dump
otherwise. --template still returns the redacted structure alone.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
Fredrik Johansson
2026-07-16 16:52:02 +02:00
parent 04b48e05e4
commit a640bc1faf
4 changed files with 31 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
README.md
View File

@@ -124,14 +124,19 @@ Comments explaining *where a value comes from* or *why it exists* are
exactly the kind of context a bare key/value pair throws away, so this
keeps it without keeping the secret itself around unencrypted anywhere.
A plain `keep pull` uses that template by default: if the vault has one,
you get real values filled back into it, comments and all — not just a
bare key/value dump. Ask for the redacted structure itself with:
```bash
keep pull myapp/production --template > .env.example
```
Vaults pushed before this existed just don't have a saved template —
`keep pull --template` on one of those fails with a clear error instead
of silently returning nothing. No migration needed; push again and the
template gets backfilled from whatever `.env` you push next.
`keep pull` on one of those falls back to a plain key/value dump, and
`keep pull --template` fails with a clear error instead of silently
returning nothing. No migration needed; push again and the template
gets backfilled from whatever `.env` you push next.
## Granting, revoking, rotating