Open source · Self-hosted · Apache 2.0
Envious
Self-hosted environment variable manager
Stop scattering .env files across servers and laptops. Run one
SQLite-backed server with an admin dashboard and audit trail, and manage
every application, environment, and variable — versioned, optionally
encrypted, and one CLI call away.
$ ./envious login --api-key=*** --api-base=http://127.0.0.1:8080
login saved
$ ./envious app create billing
ok
$ ./envious env create prod --app-id=2
ok
$ ./envious var set 10 DATABASE_URL "postgres://..."
ok
# every step above is written to the audit trailWhat is Envious?
Envious is a self-hosted secrets-and-config manager for teams that outgrow
loose .env files but don't need Vault-scale infrastructure. One
server (envious-server: REST API + admin dashboard, SQLite storage)
holds every application, environment, and variable. One CLI
(envious) creates, lists, sets, exports, and imports them —
on Linux, macOS, and Windows. It is Apache-2.0-licensed open source, ready for
enterprise use: structured JSON logs for any collector, a full audit trail,
and versioned, encrypted storage.
Why use Envious?
One source of truth for configuration, from side project to production.
- End secret sprawl — Every app, environment, and variable lives in one SQLite-backed server instead of chat threads and backup folders.
- Onboard in minutes — New teammates log in once and export the exact working
.env. No more copy-paste over chat. - Promote with confidence — First-class
dev/staging/prodenvironments make drift visible. - Prove what changed — Per-variable versioning plus an append-only audit trail (who, what, when, from where).
- Run anywhere — A single binary plus a single file. Localhost, VPS, homelab, or container.
When to use Envious?
Anywhere configuration is currently a folder of .env.backup files.
Multi-environment services
Keep dev, staging, and prod variables for every app side by side, and seed one environment from another with export and import.
Team onboarding
Teammates run login once, then var export the environment they need. Access is one admin key to rotate, not fifty files to chase.
Regulated and audited shops
Every mutation lands in the audit trail — queryable via the API and streamed as JSON logs to Fluent Bit, Loki, or Elasticsearch for retention and alerting.
CI/CD configuration
Pipelines fetch the target environment through the CLI or API and write a .env at deploy time. No secrets baked into images or repos.
Advantages at a glance
- One binary plus one SQLite file — backups are a file copy.
- Admin dashboard and CLI speak the same audited API.
- Per-variable versioning on every update.
- Optional encryption at rest for stored values.
- Structured JSON logs with request IDs for any log collector.
- Cross-platform releases plus a multi-arch Docker image.
What you can do
Everything in the dashboard is also in the CLI — and everything is audited.
Organize by app and environment
Applications contain environments, environments contain variables. The hierarchy matches how you deploy.
Version every change
Setting an existing key bumps its version counter, so updates are traceable without external tooling.
Audit everything
Mutations and logins land in an append-only trail with actor, IP, and request ID — in SQLite and on the log stream.
Round-trip .env files
var export prints what var import (and your app) consumes. The dashboard imports uploads too.
Collector-native logging
JSON to stdout with levels and correlation IDs — Fluent Bit, Loki, and CloudWatch ingest it with stock parsers.
Run it your way
Local binaries, Docker image, or release assets. No account, no subscription, Apache 2.0 licensed.