@acegalaxy/vault-sync

CLI tools for @acegalaxy/notion-vault — sync secrets from a Notion vault DB into a local .env file or stdout.

• Atomic file write (temp + rename)
• chmod 600 on output (no group/world read)
• Logs to stderr only — never prints secret values
• Exit codes: 0 OK, 1 error, 2 config issue
• Cron-safe (idempotent, no partial writes)

Install

npm install -g @acegalaxy/vault-sync

Bins

| Command | Purpose | |---|---| | sync-vault | Fetch vault → atomic write to --output=<file> (cron entry point) | | load-vault | Fetch vault → stdout (env / JSON / stats) for shell pipelines |

Quick start

Place a .env-bootstrap in your CWD with the bootstrap token + bootstrap DB ID:

NOTION_BOOTSTRAP_TOKEN=secret_xxxxx
NOTION_BOOTSTRAP_DB_ID=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
NOTION_VAULT_ENV=LOCAL

Then:

# Write secrets to a file (cron-safe)
sync-vault --output=.env.vault --project=myproject --env=LOCAL

# Print to stdout (.env format)
load-vault --project=myproject --env=LOCAL

# Print stats only (counts, no values — safe to log)
load-vault --stats --project=myproject

# Output as JSON
load-vault --project=myproject --json

Cron example

*/30 * * * * cd /opt/myapp && /usr/local/bin/sync-vault --output=.env.vault --project=myapp --env=PROD >> /var/log/vault-sync.log 2>&1

Configuration

Defaults read from <CWD>/.env-bootstrap. Override:

• --env-file=<path> — bootstrap config path
• VAULT_SYNC_ROOT=<path> — env var alternative

Security notes

• Output file is written 0600 (owner read-only).
• --stats is the only mode safe to commit to log files.
• [info] lines on stderr only show counts and category breakdowns, never values.
• The bootstrap token (.env-bootstrap) MUST be chmod 600 and git-ignored.

License

MIT © ACE Galaxy