Platforms
Envlet on Fly.io
fly secrets set ENVLET_TOKEN once, then start the machine through the CLI or inject with the SDK.
ENVLET_TOKENset with fly
Set up
Three steps. The host keeps one secret and everything else arrives at boot.
- 01
Create a token
Add Fly.io under Access and create a token for the environment it deploys.
ci/flyciIts own token, separate from your login.- token
- envlet_•••••••• shown once
- opens
- one project, one environment
- expires
- always
- 02
Set one secret
fly secrets set stores ENVLET_TOKEN on the app.
Set the tokenfly secrets set ENVLET_TOKEN=envlet_... - 03
Start through Envlet
Prefix the process command with envlet run, or call inject() at boot if you prefer the SDK.
Start through the CLI[processes] app = "npx -y @envlet/cli run -- node server.js"
What the host keeps
One secret in Fly.io. Rotate everything else in Envlet without touching the host.
Fly.io / production / environment variables
| ENVLET_TOKEN | envlet_•••••••• | the only secret the host keeps |
| DATABASE_URL | •••••••• | moved to Envlet |
| STRIPE_KEY | •••••••• | moved to Envlet |
| SENTRY_DSN | •••••••• | moved to Envlet |
Questions
Will my app start if Envlet is down?
No. It retries for a few seconds, then fails so you notice. It never starts with half an environment.
Do I still need Fly.io's own secret store?
Only for ENVLET_TOKEN. Everything else lives in Envlet, so you rotate in one place.