Old School / New Tech
Old school thinking meets new tech — live, unfiltered podcast, hosted by Ran Aroussi and a co-host you won’t see coming
​Live every episode. No production lag, no editing. Business, AI, tech, startup ideas, and whatever's worth talking about — through the lens of someone who's been building production systems for 35+ years.
Join the live podcast (and stick around after for the AMA) at:
https://aroussi.com/live
Old School / New Tech
E05: Sessions - I built an Open-Source Secrets Tool Live (and OBS Died Halfway)
Use Left/Right to seek, Home/End to jump to start or end. Hold shift to jump forward or backward.
Why can't we just commit our .env files?" A clip of that question showed up on my feed, and instead of tweeting about it, I sat down and built the answer - live, in one sitting, from an empty repo to a working open-source tool.
This is that build. Envapor is a Git-native utility that encrypts the values in your .env files: you edit .env exactly like you do now, Git stores it encrypted on commit and hands back plaintext on checkout. No .env.enc, no wrapper commands, nothing to change about how your app loads config.
Along the way: why deterministic encryption is the whole ballgame for keeping diffs readable, the difference between a tool that looks done and one you'd actually trust with production secrets, an unplanned OBS crash 20 minutes in that moved the whole thing to YouTube, and the judgment calls an AI agent gets subtly wrong that would've shipped a broken security tool.
Two and a half hours, no script, no highlight reel. The finished tool is open source and linked below.
🔗 Repo: https://github.com/automazeio/envapor
🔗 Full unedited build (YouTube): https://www.youtube.com/watch?v=p4BYP9DFp9c&list=PLWwTwUPfg-UU
-----
This podcast is sponsored by Automaze, the fractional CTO partner for founders and operators. Whether you’re building a high-tech MVP or modernizing internal ops with AI and automation, Automaze can help you scale without the overhead of a full-time team.
Learn more: automaze.io
Hello everyone, Rana Rossi here, and uh this is gonna be a reattempt of trying to compensate for yesterday's failure. I was attempting to uh broadcast um uh work with me, uh code with me session for a um an utility that will allow us to keep um to push and commit environmental files securely into Git repositories. Uh for some reason my OBS uh uh completely uh misfired and uh we had uh essentially the first 20 minutes or so of the broadcast kind of completely gone. The good thing is that it was all about reviewing the PRD and what we're trying to build and the rest of the build with me. Um I was able to salvage it by broadcasting directly to YouTube. So what I'm gonna do right now, I'm going to um try to recap kind of what the PRD was, what the product that we're trying to build is, and then I'm going to stitch it with uh part of the video that I was able to salvage. Alright, so what I was trying to build essentially is um let me share my screen real quick. Um so what I was trying to build is something called Invapor. Um and we started with a completely empty repository, essentially all only had this uh a PRD file. The idea was to have a lightweight utility that will allow us to uh commit environment files, as I mentioned, securely. And the reason is is that if you're managing a team or managing a team of agents, is every time someone adds a new uh variable to their env file, uh they have to update their whole team, make sure that they have uh uh the right uh um uh values for it. And it kind of gets uh very messy real quick, and if someone forgets to update, then their next uh git pool will uh um break the app. So I was set to build something that will um uh allow us to uh um have a utility that hooks into the Git flow and once you initiate it with uh the uh um um a security key, it will then um encrypt them during transit and in the git repository, but locally you will have everything that you need to. Uh so for example here's an environment file, you can see how it looks in um once it's encrypted. So this is how it looks inside the um inside the the git repository, but locally, if I'll try to open it, you're gonna see um hello world here. Um and I encourage you to do that because I've um oh I haven't um uploaded the actual key for you to test with. Uh I'll upload the key to the repository. Um but yeah, it's it's all secure. All you have to really do between the team members is make sure that you uh uh distribute the right uh PEM file uh or generate a new one. There's also um commands for migrating from an old key to a new key. So if a new uh if there's a team member that left uh you'll have to change the obviously the database, uh username and password and all of that, and then uh just uh migrate the encryption from uh the key that they had access to to a new one that that they don't. So um that's basically it. And I've started the um I've started the the video with let's uh um basically read the repository and I'm sorry, read the PRD that wasn't a repository yet, and let's build the thing. And um yeah, I think that's pretty much the gist of it. I invite you, I kept the original PRD in the repository. You're more than welcome to review it and uh kind of follow through to how we did the how we went from having nothing to having um fully functioning uh open source utility uh that is extremely useful to be honest. And it only took about two and a half, three hours. So um yeah, I'm gonna say goodbye now and stitch the better part of the video that held through. And I'll see you next week on the next episode. So we've seen the PRD. That's that's the PRD, that's what we're uh going to attempt to do. And the first thing I'm going to use my trusty uh droid. Um I really really like it. And I'm going to start off with I think this is an empty directory, right? I don't think that I've even cloned. Okay, I only have the PRD here. I don't think that I've even set the um the git repository, so let's let's do that. We're gonna do git init. Uh and remote. Let's do this. And yeah, I think we're good for now. Okay, let's do a pull. So make sure that we have the yeah, yeah, yeah. Remote origin. What do you want? I'm just gonna make my life a whole lot easier. And we're gonna start from scratch. Cool. Okay, so I basically have the git repository here. And let's start. I'm gonna start with using um droids local model. And um yeah, let's put some music and have fun. I need a refresh maybe so it will be aware. Yeah, okay. Alright. Um let's make a plan. Is there a way for me to maybe make the font a bit bigger? So it's easy to read for everyone. What's going on with uh X streaming? All right, let's hopefully this would work. Okay, reading the full PRD. Yeah, nothing exists, obviously. Anything new here in the broadcast? No. Oh, for the love of God. We're still on uh Google maybe on YouTube, yeah. Okay, YouTube still works. Okay, at least we have that. Alright, so what do we have here? Yeah, single go binary, crypto core, yeah. Let's see. So if they're readable, yes.
SPEAKER_02Okay.
SPEAKER_03Yeah, we need to be deterministic, so obviously. So we need to install it so we have uh vapor local digital plain text. Good. Nice. I didn't actually think about that. That's that's nice. So the diff locally will show the values. Okay, um config keys, name, comments, key gym. Few choices. Okay, PRD says encryption must be deterministic, and every teammate shares the same PIM to both encrypt and decrypt. That points to systematic crypto. Uh deterministic, yes, that's right, with uh synthetic IV as similar. Of course, of course, we're gonna do it. Uh let's go with the easier part. I think it's fine to use Cobra and yeah, we're gonna start with full. Um and this is yeah, this is the bowl of the path. So uh make sure the okay, make sure the code goes in SRC. I would come on, I would want to have a demo folder and an agent skill folder later. So I think that's would help. Okay, so it's starting building, thinking. All right, still didn't do anything, nice. I don't think it's gonna be a long build. I want to check that Automaze on GitHub has a brew, homebrewing. Yeah, we do have a homebrew tab, okay. So we'll be able to do that. We'll be able to do no okay, so this is for proof. We're gonna have another one. Cool.
SPEAKER_00Um, I'm not gonna do that.
SPEAKER_03Maybe we can use it as a git. Yeah, let's also build it as a git um extension. So we can use it either and vapor init or git in vapor init. So we can turn it into a subcommand of git. We'll see. We we need to we need to have it uh working first. All right. But yeah, it seems to me like it's a bit too much. I'm gonna give it another task in the meantime. Uh while we build there. I love the we, it's always we build. Let's uh I'll just speak. Okay. While we're building the actual application, please uh create a directory named docs and uh start uh creating a user guide inside of it as if it's already done, and then I'm going to review it to ensure that the uh user experience is exactly as intended. Okay, so this is the main track, GitHub action. What's going on with that? Or he's building it in the uh in a different tree. No, so why am I not seeing these files? Oh, it's building it into the same place. Interesting.
unknownOkay, I'm gonna go.
SPEAKER_03Okay, yeah, yeah, yeah, fine. Stop the other session, that's fine. Uh I'm gonna stop the other session. Uh and um I need you to take over both uh versions and try to make sense of everything. I was afraid that's going to happen. Let's stop that different styles. Oh, okay. Actually coding two different styles. A very new repository is not the best way to do multiple writes. Let's let's let it finish the base uh kind of the the bass line, and then we're gonna spin out different uh fork trees. Yes, now you indeed have sole ownership. Okay, let's start reviewing some of the files, get of action and vapor, and ignore this for now. Decided it's MIT, I'm pretty sure that I went with Apache. Right? Yeah, I went with Apache. not MIT could be MIT, what do I care? Okay, user guide, that's fine, we've seen that. Fine. Okay, see what's happening here. Full life cycle works, okay, show use the oh my god. Use the proof skill to show me it works. The proof skill by the way is something that we've uh created automaze. I highly recommend you give it a try. It's actually gonna be proof. It's a skill and a utility and something you can put inside your code that will allow you to um see visual proof of work of anything that's happening in a terminal or a web browser and even in uh simulators like um iPhone simulator and uh stuff like that so it's really cool uh we've been using it a lot um it's proof itself let's see if there's a demo here somewhere no there's no I didn't link to a demo anyway but this is pretty much how it looks and it's quite quite cool let's see what I'm gonna get here that's absolutely not true but fine oh okay that's my developing stuff you should never demonstrate on your uh own local machine where all the installations are broken okay show me the proof let's see the proof evidence vapor yeah okay not that report all right can I see it even even slower it's too fast for me created a key this was the data we ended wait what this was the data we're running doctor we got the encryption okay oh sorry so we got it encrypted and then untouched foul tree human readable t all right seems to work um where were we just do this I have a larger screen uh okay all right let me just write this down so I can uh I'll write it down all right so I won't forget one second I think I have a guest coming in one second hello okay do you want some no right not right now thank you we've got chocolate strawberry and lemon I'll get an ice cream afterwards oh we also got we also got chocolate Natan and chocolate fudge okay all right close the door I'm in the middle of the call with people hold on okay so uh we have the artifacts things seem to be working and Noble and maze okay good uh before we um build the what I'm gonna do I wanna have fable on it and I think high is a good okay so before we build the GitHub action let's uh take uh more um let's take a deeper look at the code and review it both in terms oh my god terms of uh quality and security Fable is really good at this safety check oh my god really please modify your request to avoid really fable let's try my code seriously okay where is soul better call soul right with you this is I've I've I I haven't seen this thing before modify a request let's see if I'm gonna run this on Cloud code directly let's see what what what would happen on the deep odd wait I don't think that I'm on fable I'm an Opus eight okay so no no model it's a fable and now okay really sure thank you not log in no do it didn't happen here it only happened in droid hey droid people I guess that now we just wait. In the meantime what I can do while it's doing the audit the code is done please check we that we have full parity with the user guide is right I should understand that it's really gonna be interesting to see how Opus 5 is going to be compared to Fable I think that Anthropic is more interested to know how it compares to Sol but uh it's gonna be an interesting week allowance as part of the Max and Pro subscriptions for another week. What's the most important thing is to make sure that the keys are always encrypted and we're gonna run some tests we're gonna see that I have um yeah okay I have this repository voluntarity discrepancy that's right go ahead and update the book what's happening here where is uh where is Fable oops we better have some report um one thing that I want to do is like to uh let's see. I don't think that people will install it as a Go uh library I think that instead people need uh the option to install it using a PowerShell on the Windows we're already planning homebrew on uh macOS I don't know why the doc says that it's a Linux as well it is not so for Linux we need a curl base installer to live alongside the Go installer. So document it first in a way that makes sense and then I'll let the coding agent actually make it happen okay so we got some sort of report did this finish what the no it's not finished it's still working okay so fable was faster than Sol interesting um okay let's see I'm gonna stop it it's fine um where's the report come on come on show me the report okay if I'm giving Able here and where's the installation part? Let's see if it fixed it right exactly okay gonna come back to that oh my god I can't believe this thing okay the weather here from uh factory this thing needs to be fixed asking you to fix bugs come on all right let's give it a soul we get a code review in the meantime nice catch this one so if a value starts with the like a um a UTF secret or it it would just wouldn't work so that that's a very good catch nice good catch from multi lines same issue it's continue silently skating the plaintest there okay good okay all right all makes sense all reasonable dogs here are done okay um I wouldn't call it the script a shim that runs uh curl under the hood and installs to a homebrew okay so this is just uh an easier way to do uh homebrew install and uninstall for this utility what did I do here this is for the proof so essentially the same thing so we are what about an hour in all bad we're almost done in about an hour we're gonna have a new tool Okay. That auto generates another one every download and pushes it on every release, if that it is. It will override this handwritten shin.
SPEAKER_00Oh, okay.
SPEAKER_03In the meantime, make sure that we have the that we have the um uh homebrew tap.
SPEAKER_02Pretty cool. Let's see if it will concur.
SPEAKER_03We want to check this locally first. What are you thinking so much? Let's give this thread another task. All right.
SPEAKER_02Okay.
SPEAKER_03Um what did I see here that I wanted to address? Actually, fine. Oh.
SPEAKER_01Okay. So what do we do?
SPEAKER_03Let's open up code the demo not in the demo in the root. Oops. Let's create an end five. Let's call this public key.
SPEAKER_02So this is what I need to do. Okay. We'll see how this goes.
unknownOkay.
SPEAKER_02Okay.
SPEAKER_03Okay, good. So we have all the commands here. For in vapor, I'm going to start with Keygen and I'm gonna call it demo, create a demo here. See this file. Alright. And now we can do an vapor in it. Um and I need to supply the PEM file, right? What what are the docs saying? Yeah. Okay, so already I see some usability issue. Let's make sure that make sure that in it accepts both and so also the letter will look for and use it if it exists. Fail if does not.
SPEAKER_05Okay.
SPEAKER_03Uh way of using it instead of doing PEM every time. Okay, so it's initialized. Let's run the doctor. Okay. So let me commit uh add testing um encryption, make sure there's a type somewhere, and get okay. So here I should see the environment file and it should be good. Exactly what we wanted now. Let me try to copy it to another place. So let me go through the desktop for a second. Get uh clone. What do I have here? This is what I get, and I need I need to do the init, I think, again in order to okay. So now I'm seeing the right key. Okay, so it did work. Cool. Let's make a change in this key. Uh and the change would be hello world modified. Commit testing encryption git push. So am I gonna see? Okay, let me do a git pull here on the original. So N was modified. Yep. Nice aroni. Exactly what we want. So okay, that's another idea to migrate it. Uh I want another command and vapor keys. I wanna see what I have. Oh, maybe the status is already there, right? Right. No, the status for this, okay, for this repository. The one thing not thrilled about is this demo key. It's a bit short. I want it a heck of a long time. Okay, so let's pretend that a team member just left. I want to create a new key chain, so and we're gonna call the demo two. And now I want to migrate this repository from demo to demo two.
unknownWhat?
SPEAKER_03I know the demo is a directory, but it's also a key. What? So we need all PEM. Yeah, okay, we have an issue there. So this is an edge case, this is not good. Still weak. Okay. Am I getting a better key now? Better key, okay. Oh, not keeping ends on. How come everything is up to date if I did a migration?
SPEAKER_01Okay.
SPEAKER_03All right, okay. Cause it did it on on on push. Uh let's see. So this one on the desktop should not work for me.
SPEAKER_01Yep, good.
SPEAKER_03Okay. Uh when I did uh still getting used to this mechanical keyboard. I got good.
SPEAKER_00Changed. Good.
SPEAKER_03Um pretty sure we're done. What we need to do is to create a test. It's called dogs, but it was here, huh?
SPEAKER_02Okay. Good.
SPEAKER_03Exactly the desired behavior indeed. Oh, this would be nice not worrying about uh environment variables anymore.
SPEAKER_01Let's add a pen as secret here. For the testing secrets and variables, actions, nice environment.
SPEAKER_03Wait, wait, wait. Hold them or two. So the action work we had okay. Yes, let's test the installers. I'll install it on a remote server, just so I'll have it uh I can test it. Let's go to one of my servers. See if it installs without issues. Oh, I need to add it in. Okay, so now you'll know what this is. Okay, installs. So a curl installs, so it's here. Let me delete it and do a brew install. So the installer works as well. The one thing I cannot test right now is uh Windows, hopefully it works. Someone will tell me if it works or not in the issues, I'm sure.
SPEAKER_01And how does this look?
unknownCool.
SPEAKER_03I don't know if we need the PRD anymore. Remove it. You know what? I'll keep it as a reference if people are reviewing the I'm just gonna rename it. Okay. Also, why the hell are we running actions on every commit? That's fine. Yeah. It didn't let me commit because it was still pointing to the development vapor in uh in the get hook. That's the word I was looking for. All right, almost done. Should be able to take latest.
SPEAKER_01Um okay, never mind.
SPEAKER_03Pretty sure we're done though. I never thought I'm gonna see a rule that says never add. That's funny. Okay. Let's create a git extension shame. So name again, migrate fine. Currently not done. So we're just gonna create a sim link, name getting vapor, and should be done. I'm assuming that in about ten minutes we're gonna have it completely done and ready. I'll probably add a shameless plug to something on the README file, but uh pretty much done. Okay, so this is done. This is being done. And we'll be done. Um then we're going to cut a new version, and I think that we are done done here. Um don't forget to add the line item to changelog.md. Something failed, but failed if it was just a rate limiting thing or something more crucial. And sold why cause a new thing is running. So this will fail as well. This did not fail. What the hell? I don't get it. That's so weird.
unknownOkay.
SPEAKER_03I can close this. Thank you, Claude, for your service.
SPEAKER_01Okay, right.
SPEAKER_03Oh, they just love this word. Okay. I think uh we can call it a day. It's actually pretty much done. This thing will get fixed in the next few minutes. And uh yeah, so that was uh let's do a proper for will. This was uh old school new tech session build with me with build uh and vapor utility for Git to allow you to add your environment variables uh and commit them without worrying. Uh thank you for stinking if for sticking around and um I hope you had a nice time. I had uh was uh close to three hours well spent. And uh we have a new open source tool now. Thank you everyone. See you in the next one. Bye bye.