foglock#

Keep passwords out of your config files, and keep the config files in git.

[database]
user = "app"
password = "@enc gAAAAABm9x2k...Q7c="

Secrets are stored encrypted, right where they are used. The key lives in one file on the server, outside the repository. Your app decrypts the values when it reads its settings.

  • Standard cryptography. Fernet (AES-128-CBC with HMAC-SHA256) from cryptography.

  • Works with any format. An encrypted value is a string starting with @enc , so it fits in TOML, YAML, JSON, INI and .env files alike.

  • Key rotation built in. Old values keep working while you re-encrypt.

  • Checks without revealing anything. foglock validate never prints secrets.

  • Dynaconf support. @enc values decrypt as settings are read.

Install#

pip install foglock
pip install "foglock[dynaconf]"   # with Dynaconf integration

Requires Python 3.9 or newer.

Quick start#

foglock genkey      # writes ./master.key (mode 0400); keep it out of git
foglock encrypt     # type the secret twice at a hidden prompt

Paste the printed @enc ... value into your config, then:

from foglock import Foglock

lock = Foglock.from_env()
password = lock.decrypt(config["database"]["password"])

Next: using it from Python, the command line, Dynaconf and what it does and does not protect.