@quantize/cellar-cli

CLI for Cellar — a lightweight, self-hosted secrets manager. Interactive TUI and scriptable commands for managing encrypted secrets across projects and environments.

Install

npm i -g @quantize/cellar-cli

Requires Node.js 20+.

Quick Start

cellar server start                  # pull & run the server via Docker
cellar login http://localhost:3000   # connect + auto-setup on first run
cellar project create my-app         # create a project
cellar env create my-app production  # add an environment
cellar secret set my-app production DATABASE_URL "postgres://..."
cellar secret list my-app production --format env

Interactive Mode

Run cellar with no arguments to launch the TUI:

cellar

Navigate projects, environments, and secrets with arrow keys. The session persists until you quit.

Commands

Server

cellar server start                  # pull image & start container
cellar server start -p 8080         # custom port
cellar server stop                   # stop the container
cellar server status                 # check if running
cellar server logs                   # show recent logs
cellar server logs -f                # follow logs

Requires Docker.

Projects

cellar project list
cellar project create my-app
cellar project delete my-app

Environments

cellar env list my-app
cellar env create my-app production
cellar env delete my-app staging

Secrets

cellar secret list my-app production
cellar secret list my-app production --format env     # KEY=VALUE output
cellar secret list my-app production --format json    # JSON array output
cellar secret get my-app production DATABASE_URL
cellar secret set my-app production DATABASE_URL "postgres://..."
cellar secret delete my-app production OLD_KEY
cellar secret bulk-set my-app production --file .env  # import from .env file

Pull to .env

cellar pull my-app production                # writes .env
cellar pull my-app production -o .env.local  # custom output path

Sync

cellar sync my-app production --file .env    # diff + interactive push/pull

Manifest

Define expected secrets in cellar.json:

{
  "project": "my-app",
  "environment": "production",
  "keys": ["DATABASE_URL", "API_KEY", "JWT_SECRET"]
}

cellar manifest check   # verify all keys exist on the server
cellar manifest pull    # pull matching secrets to .env

Users & API Keys

cellar user list
cellar user create "CI Bot"
cellar api-key create "deploy" --user <user-id>
cellar api-key revoke <key-id> --user <user-id>

Access Control

cellar access grant my-app <user-id> --permission write
cellar access revoke my-app <user-id>

Import from Infisical

cellar import infisical --url https://infisical.example.com --token <token>
cellar import infisical --url https://infisical.example.com --token <token> --dry-run

Configuration

Credentials are stored at ~/.cellar/config.json after cellar login. The file contains the server URL and API key.

Part of the Cellar Monorepo

| Package | Description | |---------|-------------| | @quantize/cellar-server | Hono + SQLite server with AES-256-GCM encryption | | @quantize/cellar-cli | This package — interactive + scriptable CLI |

License

MIT