Bun

Start with a Hono Bun app. Install Dotenvx:

$ bun add @dotenvx/dotenvx

Disable Bun's automatic .env loading so Dotenvx controls which file is decrypted:

# bunfig.toml
env = false

Use Bun's server instead of the Node adapter:

// src/index.ts
import { Hono } from 'hono'

const app = new Hono()

app.get('/', (c) => c.text(`Hello ${process.env.HELLO}`))

export default {
  fetch: app.fetch,
  port: Number(process.env.PORT || 3000),
  hostname: process.env.HOST || '127.0.0.1'
}

Update your package scripts:

{
  "scripts": {
    "dev": "bunx --bun dotenvx run --strict -- bun src/index.ts",
    "start": "bunx --bun dotenvx run -f .env.production --strict -- bun src/index.ts"
  }
}

Follow Encrypt and Commit, using bunx --bun dotenvx in place of npx dotenvx.

$ bun run dev

Visit http://localhost:3000 to see Hello Secret.

Follow Share for team access. For Production, install Bun on your host, deploy bunfig.toml with your app and encrypted file, and use bun install and bun run start. Set HOST to 0.0.0.0 and provision the production key as described there.