NestJS

Encrypt a .env file in NestJS with Dotenvx, commit it safely, and load its secrets at runtime.

Prerequisites

Install

In your NestJS project, install Dotenvx.

$ npm install @dotenvx/dotenvx

$ pnpm add @dotenvx/dotenvx

Encrypt

Start with a secret value in the .env file at your project root, like:

# .env
HELLO="Secret"

Encrypt it with a single command.

$ npx dotenvx encrypt
◈ encrypted .env (022 0D8) via .env.keys ⛉

$ pnpm exec dotenvx encrypt
◈ encrypted .env (022 0D8) via .env.keys ⛉

The values become ciphertext and only your private key can unlock them.

# .env
DOTENV_PUBLIC_KEY="0220d830351410598be484f43a7b07097e09851f50426832876e8b5815a1752990"

HELLO="encrypted:BHLTACNJMr00nTG6yXpkCyWFKF/MY0ajN855tg3uVtKopTe2AGzSkQlcPd21pTOT3Ci8IKrdIg2TMZFoq1mDR6yb06QCRvqHXtpkZkAHYCEHfeWqqC8tMFovcYq5JS2uZSrC/qUGDA=="

Commit

Commit your encrypted .env files with your code. It's safe. Now you can securely share secrets through git.

$ git add .env
$ git commit -m "encrypt .env"

Ship

Read your secret in the starter app's service:

// src/app.service.ts
import { Injectable } from '@nestjs/common';

@Injectable()
export class AppService {
  getHello(): string {
    return `Hello ${process.env.HELLO}`;
  }
}

Update these scripts in package.json, keeping your other scripts:

{
  "scripts": {
    "build": "nest build",
    "start": "dotenvx run -- nest start",
    "start:dev": "dotenvx run -- nest start --watch",
    "start:prod": "dotenvx run -f .env.production --strict -- node dist/main.js"
  }
}

Run your app:

$ npm start
⟐ injected env (2) from .env (022 0D8) via .env.keys

$ pnpm start
⟐ injected env (2) from .env (022 0D8) via .env.keys

Dotenvx loads and decrypts .env before NestJS initializes your modules. Use npm run start:dev or pnpm start:dev to watch for code changes.

Visit http://localhost:3000 to see Hello Secret.

Hello Secret

Use ConfigService Alternative →

Have teammates? Share access with Dotenvx Armor ⛨

$ npx dotenvx login
◉ logged in (username)

$ pnpm exec dotenvx login
◉ logged in (username)

Create the Armored Key ⛨

$ npx dotenvx armor up
⛨ armored .env (022 0D8)

$ pnpm exec dotenvx armor up
⛨ armored .env (022 0D8)

Invite your teammate.

$ npx dotenvx armor invite
⛨ invited [email protected] to team

$ pnpm exec dotenvx armor invite
⛨ invited [email protected] to team

Your teammate accepts the invitation, pulls the repository, installs dependencies, and logs in with dotenvx login. They can then run the app:

$ npm start
⟐ injected env (2) from .env (022 0D8) via Armor ⛨

$ pnpm start
⟐ injected env (2) from .env (022 0D8) via Armor ⛨

Visit http://localhost:3000 to see Hello Secret.

Hello Secret

Share a private key Alternative →

Production

Create a .env.production file.

# .env.production
HELLO="Production"

Encrypt it with an Enclaved Key ◊

$ npx dotenvx encrypt -f .env.production
◈ encrypted .env.production (022 0D8) via Armor Enclave ◊

$ pnpm exec dotenvx encrypt -f .env.production
◈ encrypted .env.production (022 0D8) via Armor Enclave ◊

When prompted, choose Enclaved, select your deployment service, connection, and resource, and use DOTENV_PRIVATE_KEY_PRODUCTION as the private key name.

Commit .env.production.

$ git add -f .env.production
$ git commit -m "encrypt .env.production"

Install dependencies and build your app in your deployment build step:

$ npm install
$ npm run build

$ pnpm install
$ pnpm build

Deploy the compiled dist directory, package.json, runtime dependencies, and encrypted .env.production file to the selected resource. Keep .env.production at the project root and .env.keys on your local machine.

Set NODE_ENV to production in your deployment environment. From the project root, run:

$ npm run start:prod

$ pnpm start:prod

Dotenvx loads and decrypts .env.production with your Enclaved Key ◊

Open your deployed app's URL to see Hello Production.

Hello Production

Deploy with a private key Alternative →

Conclusion

You've encrypted your secrets, shared access with Armor, and loaded production secrets in NestJS with an Enclaved Key. Your secrets now travel with your code.