Raaz CLI

Raaz (raaz) is a command-line tool for pushing and pulling .env secret files to and from pluggable cloud secret backends, keyed by an app / env / provider context.

Overview

Instead of hand-rolling scripts around each cloud vendor's secret store, Raaz gives you one consistent workflow — raaz push and raaz pull — that works the same way whether your secrets live in AWS Secrets Manager, GCP Secret Manager, Azure Key Vault, OCI Vault, or just on your own filesystem.

Install

Not on PyPI yet — clone and install locally for now. This one command is everything you need.

git clone https://github.com/tisaksen/raaz.git && cd raaz
uv pip install -e .

Need a specific provider's dependencies too? Add it as an extra, e.g. uv pip install -e ".[aws]" — see Supported providers below for the rest.

Quick start

raaz init myapp dev local   # no cloud credentials needed to try it — "local" needs none
raaz push                   # send every .env file in this project to that context
raaz pull                   # ...later, from anywhere with the same app/env/provider
raaz run -- java -jar app.jar   # ...or skip the file entirely, inject secrets straight into a process

See Getting Started for a full walkthrough, including setting up cloud provider credentials.

Commands at a glance


`init`	Establish the app/env/provider context for a project.
`push` / `pull`	Sync `.env`-style files with the current context.
`status`	One glance: context, credentials, and drift — the command to reach for daily.
`diff`	Local vs. remote, or remote env vs. remote env (`--against`).
`matrix`	One file's keys across every environment at once.
`share`	A one-time-read link for any file — no cloud credentials, no raaz install, to view it.
`rollback`	Restore local files from a pre-pull backup.
`run`	Inject secrets as env vars into a subprocess — nothing touches disk.

Full details for every command: CLI Reference.

Supported providers

Provider	Backend	Extra
`aws`	AWS Secrets Manager	`raaz[aws]`
`gcp`	GCP Secret Manager	`raaz[gcp]`
`azure`	Azure Key Vault	`raaz[azure]`
`oci`	OCI Vault	`raaz[oci]`
`vault`	HashiCorp Vault (KV v2, token auth)	`raaz[vault]`
`1password`	1Password (Secrets Automation / Service Accounts)	`raaz[1password]`
`bitwarden`	Bitwarden Secrets Manager	`raaz[bitwarden]`
`local`	Your own filesystem, encrypted at rest via your OS keychain	included in the base install

More providers can be added without touching this repo — see Providers for the plugin interface.

How secrets are organized

Every secret is scoped to an app / env / provider triple, e.g. myapp / dev / aws. That context is saved to .raaz/context.json in your project directory (raaz ctx show / raaz ctx use to inspect or change it), so you don't have to pass --app/--env/--provider on every command once it's set.

By default, push finds every .env-style file in the project root and pushes each one under a secret name derived from its filename; pull writes them back the same way, overwriting whatever's already there.

Don't want .env files sitting in the project root at all? On first setup, raaz init asks (once) whether to store them under a subfolder of .raaz/ instead - e.g. .raaz/dots/. Declining (the default) keeps them at the project root; opting in moves them there instead, and every push/pull/diff/status transparently reads and writes that folder from then on. Change your mind later with raaz ctx use --dir <name>, or override it for a single command with --dir <name> - see CLI Reference for the full prompt flow.

Documentation

Getting Started — cloud provider credentials, running processes without disk writes, switching environments, cleanup, sharing
Providers — cloud vendor integrations and writing your own
CLI Reference — every available command

License

PolyForm Strict License 1.0.0 — noncommercial use only; no redistribution or modified/derivative copies without a separate agreement with the copyright holder. This is not an open-source license. PRs from invited collaborators are still welcome — see CONTRIBUTING.md. For commercial use, contact thomas.isaksen@gmail.com.