I built envdirx around a simple convention: one file per environment variable. If you like DJB envdir but want encryption for selected values, envdirx keeps that layout. Ordinary settings stay plaintext; secrets can be encrypted individually. Both work in the same directory. A few details: - set NAME stores plaintext; set -c NAME encrypts. - Encrypting needs only the public key. The private key stays outside the environment directory. - run -- your-command decrypts encrypted entries and passes the values as environment variables. - Existing plaintext entries can be encrypted by name or with encrypt --all. Install with uv tool install envdirx. It requires Python 3.13+ and a POSIX system. This is a local CLI, not a hosted secrets manager. Encryption protects stored values; it does not hide them from the running application or prevent that application from logging them. It also doesn't use dotenvx's ciphertext or key format. The code is MIT-licensed: https://github.com/tumf/envdirx If you already use envdir or file-based configuration, I'd like to hear where this fits your workflow and what makes migration difficult.

envdirx

Encrypted environment variables, one file at a time

Encrypted environment variables, one file at a time