Setting and forgetting secrets in the environment with direnv and LastPass CLI

.envrc

#!/bin/bash

read_secret() {
    local path="$1"
    note="$(lpass show --notes $path 2>/dev/null)"
    if [[ $? -ne 0 ]]; then
        echo "Can't read LastPass note" >&2
        return 1
    fi
    echo "$note"
}

write_secret() {
    local path="$1"
    local contents="$2"
    if ! echo "$contents" | lpass add --non-interactive --notes "$path"; then
        echo "Can't write LastPass note" >&2
        return 1
    fi
}

set_and_forget() {
    local variable="$1"
    if [[ -z "${!variable}" ]]; then
        value="$(read_secret $PROJECT/$variable)"
        if [[ -n "$value" ]]; then
            eval "$(echo $variable=\"$value\")"
        else
            read -s -p "$variable:" "$variable"
            write_secret "$PROJECT/$variable" "${!variable}"
        fi
        export "$variable"
    fi
}

set_and_forget SUPER_SECRET_VARIABLE

README.md

Setting and forgetting secrets in the environment with direnv and LastPass CLI

Dependencies

• direnv
• LastPass CLI