vault-env-js

Put your vault secrets in your process.env

Install the package

npm install --save vault-env

Write a Secretfile in your app directory

DATABASE_URL secrets/databases/main:url

Require vault-env and the environment variables are loaded

require('vault-env')

console.log(process.env.DATABASE_URL)
// => 'postgres://...'

Provide your app with VAULT_ADDR and VAULT_TOKEN environment variables when you run it.

VAULT_ADDR=https://localhost:8200 VAULT_TOKEN=12345 node ./app.js

Require vault-env/rotate and vault-env will request new leases before your secrets expire, keeping your environment variables up to date forever.

require('vault-env/rotate')

// check the database url
console.log(process.env.DATABASE_URL)
// => 'postgres://username:password@host/db'

// check again in six weeks
setTimeout(function () {
  console.log(process.env.DATABASE_URL)
  // => 'postgres://user:newpassword@host/db'
}, 1000 * 60 * 60 * 24 * 7 * 6)

Watch for secret changes

var vaultEnv = require('vault-env/rotate')

vaultEnv.on('DATABASE_URL', function (newDB, oldDB) {
  console.log('DATABASE_URL has changed to ' + newDB + ' from ' + oldDB)
})

Require vault-env/local and vault-env will not set your environment your variables will only be exported by the module as regular variables

var secret = require('vault-env/local')

console.log(secret.DATABASE_URL)
// => 'postgres://...'