local.env
Local environment synchronization
Code changes often introduce a new environment requirement, while the value itself gets passed around later in Slack or DMs. local.env makes that coordination part of the development workflow instead.
What it is
local.env keeps local-development environment requirements synchronized with the code changes that introduce them. Repositories commit a small contract describing which schema files map to which local dotenv files; actual managed values stay out of Git.
When a pull request adds a required key, GitHub can report whether the value has been resolved. After merge, teammates pull the code and run one sync command instead of finding the right secret in an old conversation.
Security boundary
Managed values are encrypted and decrypted by the CLI. Repository encryption keys are generated on developer machines, while the server stores ciphertext and device-wrapped repository keys. GitHub receives key names and readiness metadata, not plaintext secret values.
The project is intentionally not a production secret manager, CI secret store, or browser-based secret editor. Its scope is local development coordination.
Developer workflow
The CLI covers login, repository initialization, resolving new keys, importing values, diffing, syncing, device management, and key rotation. `localenv run` can inject managed values directly into a child process so they do not need to be written back to a dotenv file at all.
Technology
The core service and CLI are written in Go. SQLite keeps the self-hosted deployment intentionally small, while age, Go's crypto packages, and OS keyrings support the client-side security model. The dashboard is a React/Vite application.
Architecture
01
PR adds an environment key
02
Readiness check detects the missing value
03
Developer resolves it from the CLI
04
Value is encrypted on the developer machine
05
Ciphertext is coordinated by the service
06
Teammates sync locally
Engineering notes
Put the requirement in Git, not the secret
The schema belongs with the code review. Values remain local and encrypted, separating a versioned requirement from its sensitive runtime value.
Make the server metadata-oriented
The coordination layer can know that a key exists and whether a repository is ready without needing the managed plaintext value.
Optimize for boring self-hosting
A narrow Go service and SQLite are enough for the first deployment model. The system avoids operational dependencies that do not directly improve the core workflow.