Cryptex

The problem it solves

Connection strings, publish profiles and environment-specific settings have to live somewhere. Keeping them out of the repository means they drift and get lost. Keeping them in the repository in plain text is a security incident waiting to happen. Cryptex lets the encrypted files live in Git next to the code they configure, with the passphrase supplied at build or deploy time.

This website's own production configuration is stored that way.

What it does

• Encrypt and decrypt individual files with a single command, with short aliases for speed.
• Encrypt or decrypt whole folders recursively, preserving structure, skipping files that are already encrypted and removing the .enc extension on the way back.
• Passphrase from wherever suits the context: an interactive prompt for people, an environment variable for pipelines, or a command-line argument when you accept the trade-off.
• Root configuration in a .cryptex.yaml file: exclusion patterns for folder operations and whether plaintext originals are removed after a successful encryption.
• Authenticated encryption so tampering with an encrypted file is detected on decryption.

Usage

dotnet tool install -g Cryptex

cryptex encrypt appsettings.Production.json appsettings.Production.json.enc
cryptex decrypt appsettings.Production.json.enc appsettings.Production.json

cryptex encrypt-folder ./Config --delete-original
cryptex decrypt-folder ./Config

In a pipeline, set CRYPTEX_PASSPHRASE from your secret store and Cryptex will not prompt.

# .cryptex.yaml
deleteOriginalOnEncrypt: true
exclude:
  - "*.log"
  - ".env"

Getting it

Cryptex is published on NuGet as Cryptex and installs as a global .NET tool. It is free to use. If you would like help fitting it into your delivery pipeline, get in touch.