Environment & security

Environment commands

phelix env manages per-app secrets. Each subcommand prompts for the app and key when run without arguments (in a TTY).

phelix env set    MyApp DATABASE_URL=postgresql://localhost/dbphelix env get    MyApp DATABASE_URL      # sensitive values are maskedphelix env list   MyApp                   # values shown as ***REDACTED***phelix env unset  MyApp DATABASE_URLphelix env check  MyApp DATABASE_URL      # exit-status friendly existence check

Encryption model

Values are encrypted at rest with AES-256-GCM. The encryption key lives at ~/.phelix/master.key (auto-generated, 0600 permissions). Registry credentials use the same encrypted storage mechanism and are never logged in plaintext.

env check is exit-status friendly - ideal for gates in build scripts and health probes.

Injection and snapshots

Encrypted values are injected into the app process at start, and snapshotted alongside each versioned build (env/vN.enc) so a rollback restores the matching env - never a binary without its configuration.

Secret masking

Execution authorization

Deployment execution can be gated at a single boundary between a validated plan and the engine: request → plan → authorization → (approval) → execution. It is off by default - a host with no ~/.phelix/authz/policy.json behaves exactly as before - and fails closed once configured: a broken policy denies rather than degrading to “allow everything”, and every refusal is a zero-mutation outcome. Authorization binds to the plan’s content hash, so a grant for one plan can never execute another.