Nx

Encrypt an Nx workspace .env file and inject its secrets when Nx runs the application.

1. Encrypt

Keep the environment file beside the Nx application and encrypt it. 
$ dotenvx encrypt -f apps/app/.env
Commit apps/app/.env, but never commit apps/app/.env.keys.

2. Run

Point -f at the application directory and run the Nx target through dotenvx. 
$ dotenvx run -f apps/app -- npx nx serve app
Dotenvx resolves apps/app/.env, decrypts it, and injects its values only into the Nx process.

3. Add a script

Keep the same command in the root package scripts if the team runs it frequently. 
{
  "scripts": {
    "dev:app": "dotenvx run -f apps/app -- nx serve app"
  }
}

For a shared root .env or separate .env.keys location, see Secrets in monorepos.