Sealr is a Go library for building encrypted secret management workflows. It provides a hexagonal, testable core with pluggable adapters for SOPS, filesystem, git, and time.
- SOPS-backed encryption/decryption for dotenv and binary files.
- Vault layout management and metadata indexing.
- Services for secrets, files, recipients, and sync workflows.
- Pluggable ports for storage, encryption, git, and clock.
go get github.com/aatuh/sealrpackage main
import (
"context"
"fmt"
"github.com/aatuh/sealr"
"github.com/aatuh/sealr/services"
)
func main() {
ctx := context.Background()
system := sealr.NewDefaultSystem()
err := system.InitService.Init(ctx, services.InitOptions{
Root: "./vault",
Name: "my-vault",
Recipients: []string{"age1example..."},
InitGit: true,
})
if err != nil {
panic(err)
}
if err := system.SecretService.Set(ctx, "./vault", "myapp", "dev", "API_KEY", "abc123"); err != nil {
panic(err)
}
data, err := system.SecretService.ExportEnv(ctx, "./vault", "myapp", "dev")
if err != nil {
panic(err)
}
fmt.Println(string(data))
}Sealr follows a hexagonal layout:
domain: value types and parsing helpersports: interfaces for side effectsservices: application use casesinfra: default OS adapters (SOPS, git, filesystem, clock)
Use NewSystem to wire your own ports for tests or alternate backends:
system, err := sealr.NewSystem(sealr.Dependencies{
FS: myFileSystem,
Encrypter: myEncrypter,
Git: myGit,
Clock: myClock,
})
if err != nil {
panic(err)
}- Go 1.25.1+
sopsandageon PATH when using the default encrypter
MIT. See LICENSE.