Feature
Encrypted environment variables
Phelix stores app environment values encrypted at rest and snapshots them with each build. A rollback restores the binary and the configuration it was built against, not whatever is set today.
simulated
postgres://api:…@db:5432/app
local keyvalue entered once · never written as plaintext
Encrypted at rest, locally
Values are encrypted with AES-256-GCM using a separate local key and decrypted only to launch the process. This is encrypted local storage on the host you control, not a remote secrets vault: an unmasked export can print plaintext, so treat host access as secret access.
simulated
active version
current pointer moves only after a successful deploy
Versioned with the build
Each build carries an environment snapshot. Rolling back to a retained version restores its paired snapshot, so a restored version runs with the configuration it was built against.
phelix env inspects and edits values per app with set, get, list, unset, and check, and apply changes on the next build or rebuild.
Frequently asked questions
Short answers; the docs go deeper.
Is Phelix a secrets manager?
No. It provides encrypted local storage with a local key for app environment values. It is not a remote vault and does not provide central key management or audit for secret access.
Do environment variables roll back with the application?
Yes. The binary and its encrypted environment snapshot are paired per version, so rollback restores both together.
One binary between git push and production.
Install the CLI, verify the host, and follow the quick start to build your first application.