E05: Sessions - I built an Open-Source Secrets Tool Live (and OBS Died Halfway)

Why can't we just commit our .env files?" A clip of that question showed up on my feed, and instead of tweeting about it, I sat down and built the answer - live, in one sitting, from an empty repo to a working open-source tool.

This is that build. Envapor is a Git-native utility that encrypts the values in your .env files: you edit .env exactly like you do now, Git stores it encrypted on commit and hands back plaintext on checkout. No .env.enc, no wrapper commands, nothing to change about how your app loads config.

Along the way: why deterministic encryption is the whole ballgame for keeping diffs readable, the difference between a tool that looks done and one you'd actually trust with production secrets, an unplanned OBS crash 20 minutes in that moved the whole thing to YouTube, and the judgment calls an AI agent gets subtly wrong that would've shipped a broken security tool.

Two and a half hours, no script, no highlight reel. The finished tool is open source and linked below.

🔗 Repo: https://github.com/automazeio/envapor
🔗 Full unedited build (YouTube): https://www.youtube.com/watch?v=p4BYP9DFp9c&list=PLWwTwUPfg-UU

-----

Old School / New Tech is produced by VarOps.

• Subscribe to the newsletter – the written version of this show, weekly: varops.com
• Read the books – Company-Scale Agentic AI (for operators and the C-suite) and Production-Grade Agentic AI (for engineers): varops.com/books
• Work with us – VarOps installs resident AI inside mid-market companies. It runs where your work already happens, sees the whole operation, and what it learns belongs to you: varops.com/transform

Creators and Guests

Host

Ran Aroussi

Building software and AI for companies that can't afford to guess | Automaze •VarOps

What is Old School / New Tech?

Old school thinking meets new tech — an unfiltered podcast, hosted by Ran Aroussi and a co-host you won’t see coming.

​Live every episode. No production lag, no editing. Business, AI, tech, startup ideas, and whatever's worth talking about — through the lens of someone who's been building production systems for 35+ years

SPEAKER_03: Hello everyone, Rana
Rossi here, and uh this is gonna

be a reattempt of trying to
compensate for yesterday's

failure.

I was attempting to uh broadcast
um uh work with me, uh code with

me session for a um an utility
that will allow us to keep um to

push and commit environmental
files securely into Git

repositories.

Uh for some reason my OBS uh uh
completely uh misfired and uh we

had uh essentially the first 20
minutes or so of the broadcast

kind of completely gone.

The good thing is that it was
all about reviewing the PRD and

what we're trying to build and
the rest of the build with me.

Um I was able to salvage it by
broadcasting directly to

YouTube.

So what I'm gonna do right now,
I'm going to um try to recap

kind of what the PRD was, what
the product that we're trying to

build is, and then I'm going to
stitch it with uh part of the

video that I was able to
salvage.

Alright, so what I was trying to
build essentially is um let me

share my screen real quick.

Um so what I was trying to build
is something called Invapor.

Um and we started with a
completely empty repository,

essentially all only had this uh
a PRD file.

The idea was to have a
lightweight utility that will

allow us to uh commit
environment files, as I

mentioned, securely.

And the reason is is that if
you're managing a team or

managing a team of agents, is
every time someone adds a new uh

variable to their env file, uh
they have to update their whole

team, make sure that they have
uh uh the right uh um uh values

for it.

And it kind of gets uh very
messy real quick, and if someone

forgets to update, then their
next uh git pool will uh um

break the app.

So I was set to build something
that will um uh allow us to uh

um have a utility that hooks
into the Git flow and once you

initiate it with uh the uh um um
a security key, it will then um

encrypt them during transit and
in the git repository, but

locally you will have everything
that you need to.

Uh so for example here's an
environment file, you can see

how it looks in um once it's
encrypted.

So this is how it looks inside
the um inside the the git

repository, but locally, if I'll
try to open it, you're gonna see

um hello world here.

Um and I encourage you to do
that because I've um oh I

haven't um uploaded the actual
key for you to test with.

Uh I'll upload the key to the
repository.

Um but yeah, it's it's all
secure.

All you have to really do
between the team members is make

sure that you uh uh distribute
the right uh PEM file uh or

generate a new one.

There's also um commands for
migrating from an old key to a

new key.

So if a new uh if there's a team
member that left uh you'll have

to change the obviously the
database, uh username and

password and all of that, and
then uh just uh migrate the

encryption from uh the key that
they had access to to a new one

that that they don't.

So um that's basically it.

And I've started the um I've
started the the video with let's

uh um basically read the
repository and I'm sorry, read

the PRD that wasn't a repository
yet, and let's build the thing.

And um yeah, I think that's
pretty much the gist of it.

I invite you, I kept the
original PRD in the repository.

You're more than welcome to
review it and uh kind of follow

through to how we did the how we
went from having nothing to

having um fully functioning uh
open source utility uh that is

extremely useful to be honest.

And it only took about two and a
half, three hours.

So um yeah, I'm gonna say
goodbye now and stitch the

better part of the video that
held through.

And I'll see you next week on
the next episode.

So we've seen the PRD.

That's that's the PRD, that's
what we're uh going to attempt

to do.

And the first thing I'm going to
use my trusty uh droid.

Um I really really like it.

And I'm going to start off with
I think this is an empty

directory, right?

I don't think that I've even
cloned.

Okay, I only have the PRD here.

I don't think that I've even set
the um the git repository, so

let's let's do that.

We're gonna do git init.

Uh and remote.

Let's do this.

And yeah, I think we're good for
now.

Okay, let's do a pull.

So make sure that we have the
yeah, yeah, yeah.

Remote origin.

What do you want?

I'm just gonna make my life a
whole lot easier.

And we're gonna start from
scratch.

Cool.

Okay, so I basically have the
git repository here.

And let's start.

I'm gonna start with using um
droids local model.

And um yeah, let's put some
music and have fun.

I need a refresh maybe so it
will be aware.

Yeah, okay.

Alright.

Um let's make a plan.

Is there a way for me to maybe
make the font a bit bigger?

So it's easy to read for
everyone.

What's going on with uh X
streaming?

All right, let's hopefully this
would work.

Okay, reading the full PRD.

Yeah, nothing exists, obviously.

Anything new here in the
broadcast?

No.

Oh, for the love of God.

We're still on uh Google maybe
on YouTube, yeah.

Okay, YouTube still works.

Okay, at least we have that.

Alright, so what do we have
here?

Yeah, single go binary, crypto
core, yeah.

Let's see.

So if they're readable, yes.

SPEAKER_02: Okay.

SPEAKER_03: Yeah, we need to be
deterministic, so obviously.

So we need to install it so we
have uh vapor local digital

plain text.

Good.

Nice.

I didn't actually think about
that.

That's that's nice.

So the diff locally will show
the values.

Okay, um config keys, name,
comments, key gym.

Few choices.

Okay, PRD says encryption must
be deterministic, and every

teammate shares the same PIM to
both encrypt and decrypt.

That points to systematic
crypto.

Uh deterministic, yes, that's
right, with uh synthetic IV as

similar.

Of course, of course, we're
gonna do it.

Uh let's go with the easier
part.

I think it's fine to use Cobra
and yeah, we're gonna start with

full.

Um and this is yeah, this is the
bowl of the path.

So uh make sure the okay, make
sure the code goes in SRC.

I would come on, I would want to
have a demo folder and an agent

skill folder later.

So I think that's would help.

Okay, so it's starting building,
thinking.

All right, still didn't do
anything, nice.

I don't think it's gonna be a
long build.

I want to check that Automaze on
GitHub has a brew, homebrewing.

Yeah, we do have a homebrew tab,
okay.

So we'll be able to do that.

We'll be able to do no okay, so
this is for proof.

We're gonna have another one.

Cool.

SPEAKER_00: Um, I'm not gonna do
that.

SPEAKER_03: Maybe we can use it
as a git.

Yeah, let's also build it as a
git um extension.

So we can use it either and
vapor init or git in vapor init.

So we can turn it into a
subcommand of git.

We'll see.

We we need to we need to have it
uh working first.

All right.

But yeah, it seems to me like
it's a bit too much.

I'm gonna give it another task
in the meantime.

Uh while we build there.

I love the we, it's always we
build.

Let's uh I'll just speak.

Okay.

While we're building the actual
application, please uh create a

directory named docs and uh
start uh creating a user guide

inside of it as if it's already
done, and then I'm going to

review it to ensure that the uh
user experience is exactly as

intended.

Okay, so this is the main track,
GitHub action.

What's going on with that?

Or he's building it in the uh in
a different tree.

No, so why am I not seeing these
files?

Oh, it's building it into the
same place.

Interesting.

unknown: Okay, I'm gonna go.

SPEAKER_03: Okay, yeah, yeah,
yeah, fine.

Stop the other session, that's
fine.

Uh I'm gonna stop the other
session.

Uh and um I need you to take
over both uh versions and try to

make sense of everything.

I was afraid that's going to
happen.

Let's stop that different
styles.

Oh, okay.

Actually coding two different
styles.

A very new repository is not the
best way to do multiple writes.

Let's let's let it finish the
base uh kind of the the bass

line, and then we're gonna spin
out different uh fork trees.

Yes, now you indeed have sole
ownership.

Okay, let's start reviewing some
of the files, get of action and

vapor, and ignore this for now.

Decided it's MIT, I'm pretty
sure that I went with Apache.

Right?

Yeah, I went with Apache.

not MIT could be MIT, what do I
care?

Okay, user guide, that's fine,
we've seen that.

Fine.

Okay, see what's happening here.

Full life cycle works, okay,
show use the oh my god.

Use the proof skill to show me
it works.

The proof skill by the way is
something that we've uh created

automaze.

I highly recommend you give it a
try.

It's actually gonna be proof.

It's a skill and a utility and
something you can put inside

your code that will allow you to
um see visual proof of work of

anything that's happening in a
terminal or a web browser and

even in uh simulators like um
iPhone simulator and uh stuff

like that so it's really cool uh
we've been using it a lot um

it's proof itself let's see if
there's a demo here somewhere no

there's no I didn't link to a
demo anyway but this is pretty

much how it looks and it's quite
quite cool let's see what I'm

gonna get here that's absolutely
not true but fine oh okay that's

my developing stuff you should
never demonstrate on your uh own

local machine where all the
installations are broken okay

show me the proof let's see the
proof evidence vapor yeah okay

not that report all right can I
see it even even slower it's too

fast for me created a key this
was the data we ended wait what

this was the data we're running
doctor we got the encryption

okay oh sorry so we got it
encrypted and then untouched

foul tree human readable t all
right seems to work um where

were we just do this I have a
larger screen uh okay all right

let me just write this down so I
can uh I'll write it down all

right so I won't forget one
second I think I have a guest

coming in one second hello okay
do you want some no right not

right now thank you we've got
chocolate strawberry and lemon

I'll get an ice cream afterwards
oh we also got we also got

chocolate Natan and chocolate
fudge okay all right close the

door I'm in the middle of the
call with people hold on okay so

uh we have the artifacts things
seem to be working and Noble and

maze okay good uh before we um
build the what I'm gonna do I

wanna have fable on it and I
think high is a good okay so

before we build the GitHub
action let's uh take uh more um

let's take a deeper look at the
code and review it both in terms

oh my god terms of uh quality
and security Fable is really

good at this safety check oh my
god really please modify your

request to avoid really fable
let's try my code seriously okay

where is soul better call soul
right with you this is I've I've

I I haven't seen this thing
before modify a request let's

see if I'm gonna run this on
Cloud code directly let's see

what what what would happen on
the deep odd wait I don't think

that I'm on fable I'm an Opus
eight okay so no no model it's a

fable and now okay really sure
thank you not log in no do it

didn't happen here it only
happened in droid hey droid

people I guess that now we just
wait.

In the meantime what I can do
while it's doing the audit the

code is done please check we
that we have full parity with

the user guide is right I should
understand that it's really

gonna be interesting to see how
Opus 5 is going to be compared

to Fable I think that Anthropic
is more interested to know how

it compares to Sol but uh it's
gonna be an interesting week

allowance as part of the Max and
Pro subscriptions for another

week.

What's the most important thing
is to make sure that the keys

are always encrypted and we're
gonna run some tests we're gonna

see that I have um yeah okay I
have this repository voluntarity

discrepancy that's right go
ahead and update the book what's

happening here where is uh where
is Fable oops we better have

some report um one thing that I
want to do is like to uh let's

see.

I don't think that people will
install it as a Go uh library I

think that instead people need
uh the option to install it

using a PowerShell on the
Windows we're already planning

homebrew on uh macOS I don't
know why the doc says that it's

a Linux as well it is not so for
Linux we need a curl base

installer to live alongside the
Go installer.

So document it first in a way
that makes sense and then I'll

let the coding agent actually
make it happen okay so we got

some sort of report did this
finish what the no it's not

finished it's still working okay
so fable was faster than Sol

interesting um okay let's see
I'm gonna stop it it's fine um

where's the report come on come
on show me the report okay if

I'm giving Able here and where's
the installation part?

Let's see if it fixed it right
exactly okay gonna come back to

that oh my god I can't believe
this thing okay the weather here

from uh factory this thing needs
to be fixed asking you to fix

bugs come on all right let's
give it a soul we get a code

review in the meantime nice
catch this one so if a value

starts with the like a um a UTF
secret or it it would just

wouldn't work so that that's a
very good catch nice good catch

from multi lines same issue it's
continue silently skating the

plaintest there okay good okay
all right all makes sense all

reasonable dogs here are done
okay um I wouldn't call it the

script a shim that runs uh curl
under the hood and installs to a

homebrew okay so this is just uh
an easier way to do uh homebrew

install and uninstall for this
utility what did I do here this

is for the proof so essentially
the same thing so we are what

about an hour in all bad we're
almost done in about an hour

we're gonna have a new tool
Okay.

That auto generates another one
every download and pushes it on

every release, if that it is.

It will override this
handwritten shin.

SPEAKER_00: Oh, okay.

SPEAKER_03: In the meantime,
make sure that we have the that

we have the um uh homebrew tap.

SPEAKER_02: Pretty cool.

Let's see if it will concur.

SPEAKER_03: We want to check
this locally first.

What are you thinking so much?

Let's give this thread another
task.

All right.

SPEAKER_02: Okay.

SPEAKER_03: Um what did I see
here that I wanted to address?

Actually, fine.

Oh.

SPEAKER_01: Okay.

So what do we do?

SPEAKER_03: Let's open up code
the demo not in the demo in the

root.

Oops.

Let's create an end five.

Let's call this public key.

SPEAKER_02: So this is what I
need to do.

Okay.

We'll see how this goes.

unknown: Okay.

SPEAKER_02: Okay.

SPEAKER_03: Okay, good.

So we have all the commands
here.

For in vapor, I'm going to start
with Keygen and I'm gonna call

it demo, create a demo here.

See this file.

Alright.

And now we can do an vapor in
it.

Um and I need to supply the PEM
file, right?

What what are the docs saying?

Yeah.

Okay, so already I see some
usability issue.

Let's make sure that make sure
that in it accepts both and so

also the letter will look for
and use it if it exists.

Fail if does not.

SPEAKER_05: Okay.

SPEAKER_03: Uh way of using it
instead of doing PEM every time.

Okay, so it's initialized.

Let's run the doctor.

Okay.

So let me commit uh add testing
um encryption, make sure there's

a type somewhere, and get okay.

So here I should see the
environment file and it should

be good.

Exactly what we wanted now.

Let me try to copy it to another
place.

So let me go through the desktop
for a second.

Get uh clone.

What do I have here?

This is what I get, and I need I
need to do the init, I think,

again in order to okay.

So now I'm seeing the right key.

Okay, so it did work.

Cool.

Let's make a change in this key.

Uh and the change would be hello
world modified.

Commit testing encryption git
push.

So am I gonna see?

Okay, let me do a git pull here
on the original.

So N was modified.

Yep.

Nice aroni.

Exactly what we want.

So okay, that's another idea to
migrate it.

Uh I want another command and
vapor keys.

I wanna see what I have.

Oh, maybe the status is already
there, right?

Right.

No, the status for this, okay,
for this repository.

The one thing not thrilled about
is this demo key.

It's a bit short.

I want it a heck of a long time.

Okay, so let's pretend that a
team member just left.

I want to create a new key
chain, so and we're gonna call

the demo two.

And now I want to migrate this
repository from demo to demo

two.

unknown: What?

SPEAKER_03: I know the demo is a
directory, but it's also a key.

What?

So we need all PEM.

Yeah, okay, we have an issue
there.

So this is an edge case, this is
not good.

Still weak.

Okay.

Am I getting a better key now?

Better key, okay.

Oh, not keeping ends on.

How come everything is up to
date if I did a migration?

SPEAKER_01: Okay.

SPEAKER_03: All right, okay.

Cause it did it on on on push.

Uh let's see.

So this one on the desktop
should not work for me.

SPEAKER_01: Yep, good.

SPEAKER_03: Okay.

Uh when I did uh still getting
used to this mechanical

keyboard.

I got good.

SPEAKER_00: Changed.

Good.

SPEAKER_03: Um pretty sure we're
done.

What we need to do is to create
a test.

It's called dogs, but it was
here, huh?

SPEAKER_02: Okay.

Good.

SPEAKER_03: Exactly the desired
behavior indeed.

Oh, this would be nice not
worrying about uh environment

variables anymore.

SPEAKER_01: Let's add a pen as
secret here.

For the testing secrets and
variables, actions, nice

environment.

SPEAKER_03: Wait, wait, wait.

Hold them or two.

So the action work we had okay.

Yes, let's test the installers.

I'll install it on a remote
server, just so I'll have it uh

I can test it.

Let's go to one of my servers.

See if it installs without
issues.

Oh, I need to add it in.

Okay, so now you'll know what
this is.

Okay, installs.

So a curl installs, so it's
here.

Let me delete it and do a brew
install.

So the installer works as well.

The one thing I cannot test
right now is uh Windows,

hopefully it works.

Someone will tell me if it works
or not in the issues, I'm sure.

SPEAKER_01: And how does this
look?

unknown: Cool.

SPEAKER_03: I don't know if we
need the PRD anymore.

Remove it.

You know what?

I'll keep it as a reference if
people are reviewing the I'm

just gonna rename it.

Okay.

Also, why the hell are we
running actions on every commit?

That's fine.

Yeah.

It didn't let me commit because
it was still pointing to the

development vapor in uh in the
get hook.

That's the word I was looking
for.

All right, almost done.

Should be able to take latest.

SPEAKER_01: Um okay, never mind.

SPEAKER_03: Pretty sure we're
done though.

I never thought I'm gonna see a
rule that says never add.

That's funny.

Okay.

Let's create a git extension
shame.

So name again, migrate fine.

Currently not done.

So we're just gonna create a sim
link, name getting vapor, and

should be done.

I'm assuming that in about ten
minutes we're gonna have it

completely done and ready.

I'll probably add a shameless
plug to something on the README

file, but uh pretty much done.

Okay, so this is done.

This is being done.

And we'll be done.

Um then we're going to cut a new
version, and I think that we are

done done here.

Um don't forget to add the line
item to changelog.md.

Something failed, but failed if
it was just a rate limiting

thing or something more crucial.

And sold why cause a new thing
is running.

So this will fail as well.

This did not fail.

What the hell?

I don't get it.

That's so weird.

unknown: Okay.

SPEAKER_03: I can close this.

Thank you, Claude, for your
service.

SPEAKER_01: Okay, right.

SPEAKER_03: Oh, they just love
this word.

Okay.

I think uh we can call it a day.

It's actually pretty much done.

This thing will get fixed in the
next few minutes.

And uh yeah, so that was uh
let's do a proper for will.

This was uh old school new tech
session build with me with build

uh and vapor utility for Git to
allow you to add your

environment variables uh and
commit them without worrying.

Uh thank you for stinking if for
sticking around and um I hope

you had a nice time.

I had uh was uh close to three
hours well spent.

And uh we have a new open source
tool now.

Thank you everyone.

See you in the next one.

Bye bye.