Encrypt a .env file in Nx

Encrypt an Nx workspace .env file and inject its secrets when Nx runs the application.

1. Encrypt

Keep the environment file beside the Nx application and encrypt it.

dotenvx encrypt -f apps/app/.env

Commit apps/app/.env, but never commit apps/app/.env.keys.

2. Run

Point -f at the application directory and run the Nx target through dotenvx.

dotenvx run -f apps/app -- npx nx serve app

Dotenvx resolves apps/app/.env, decrypts it, and injects its values only into the Nx process.

3. Add a script

Keep the same command in the root package scripts if the team runs it frequently.

{
  "scripts": {
    "dev:app": "dotenvx run -f apps/app -- nx serve app"
  }
}

For a shared root .env or separate .env.keys location, see Secrets in monorepos.