dockxo beta
FeaturesPricingBlogChangelogGet started Sign in
features/env-secrets
Encrypted at rest, .env editorsince v0.1

Environment & secrets

Environment variables are encrypted with AES-256-GCM before they touch the database. Edit them as a table or as a real .env file with syntax highlighting, then save and redeploy in one step.

  • AES-256-GCM encryption at rest with your own DOCKXO_SECRET
  • Table editor or raw .env editor with syntax highlighting
  • Comments, blank lines and order are preserved
  • Save & redeploy in one click, or PATCH single keys through the API
  • Optionally write the env as a .env file into the build context
  • Template credentials are generated for you and shown on the Connect tab

Two editors, one source of truth

Env is stored as raw .env text, so what you type is what the container gets. Switch between a key/value table for quick edits and a full editor that highlights keys, values, quotes and comments. Comments, blank lines and the order of your variables are preserved across saves; the panel never rewrites your file into something you did not write.

Encrypted before it is stored

Every value is encrypted with AES-256-GCM using the panel’s DOCKXO_SECRET before it is written to the database. The same key protects GitHub tokens, registry passwords, Cloudflare tokens, storage credentials and Telegram bot tokens. If the database leaks, your secrets do not.

Change one key from a script

PATCH /api/services/:id/env sets or unsets keys in place, so CI can rotate a token or flip a flag without touching the rest of the file. Combine it with POST …/deploy?wait=1 to redeploy and get the outcome in the same call.

Connect tab

Template services (databases, Redis, RabbitMQ…) generate their own credentials. The Connect tab shows the internal address (db on the project network, db.project from other projects), the generated user and password, and ready-to-paste connection strings for common clients. Optionally publish the port on a fixed or random free host port and restrict who can reach it with the port allowlist.