@moshaar/env

Fetch secrets from OpenBao and inject them into a spawned command — no .env files needed.

Built for Moshaar platform devs (frontend + backend).

Install

npm install -g @moshaar/env
# or use npx:
# npx @moshaar/env dev backend -- pnpm run start:dev

Prerequisites

You need OpenBao CLI installed and you need to be logged in.

1. Install OpenBao CLI

| Platform | Command | |---|---| | Windows | winget install OpenBao.OpenBao | | macOS | brew tap openbao/tap && brew install openbao | | Linux | curl -fsSL https://github.com/openbao/openbao/releases/download/v2.5.4/bao_2.5.4_Linux_x86_64.tar.gz \| sudo tar -xz -C /usr/local/bin bao |

Verify: bao --version

2. Login via GitLab OIDC

export BAO_ADDR=https://secrets.moshaar.com
bao login -method=oidc role=backend-team   # or frontend-team, devops-team

(Token TTL: 8 hours — re-login when expired.)

Usage

# Backend developer
moshaar-env dev backend -- pnpm run start:dev

# Frontend developer
moshaar-env dev frontend -- pnpm run dev:mw

# Custom folder
moshaar-env dev shared-public -- env

# Prod (requires explicit safety flag)
moshaar-env prod backend --confirm-prod -- node dist/main.js

# List secret names (no values shown)
moshaar-env --list dev backend

# Check login status
moshaar-env --status

How it works

1. Reads your OpenBao token from ~/.bao-token / ~/.vault-token / BAO_TOKEN, falling back to bao token lookup
2. Calls OpenBao API: list keys at moshaar/<env>/<folder> + moshaar/<env>/shared-public
3. Fetches all values (bounded concurrency = 6, auto-retry 2x on network errors)
4. Reads ./.env.local if present in cwd — its KEY=VALUE pairs override what came from OpenBao
5. Spawns your command with the merged secrets injected into process.env

Secrets never touch disk and never appear in stdout.

.env.local overrides (v1.1.0+)

Put per-developer infrastructure overrides in a .env.local file in your project root:

# .env.local — gitignored, per-developer
DATABASE_URL=postgresql://postgres:123@localhost:5432/moshaar_dev
REDIS_HOST=localhost
CACHE_HOST=localhost
MEILISEARCH_HOST=http://localhost:7700

OpenBao stays the source of truth for shared secrets (JWT, SMTP, API keys). .env.local overrides only host-specific values. Don't put real secrets in .env.local.

Roles available (must match your GitLab subgroup)

| Login Role | GitLab subgroup | Can read | |---|---|---| | backend-team | moshaar/backend-team | /dev/backend/* + /dev/shared-public/* | | frontend-team | moshaar/frontend-team | /dev/frontend/* + /dev/shared-public/* | | devops-team | moshaar/devops-team | All /dev/* + /staging/* + read /prod/* | | prod-backend | moshaar/prod-backend | Read /prod/backend/* + /prod/shared-public/* | | prod-frontend | moshaar/prod-frontend | Read /prod/frontend/* + /prod/shared-public/* |

If your login fails with permission errors, ask DevOps to add you to the correct GitLab subgroup.

Configuration

| Env var | Default | Notes | |---|---|---| | BAO_ADDR | https://secrets.moshaar.com | OpenBao server URL | | BAO_TOKEN | (read from ~/.bao-token) | Override token explicitly |

License

MIT — see LICENSE.