cin Kado

cin

cin means config inject.

It is a CLI for storing encrypted app config in Git and injecting resolved values into commands at runtime. Config values are encrypted with age. Plaintext is not printed unless a command explicitly asks for it.

Install

macOS:

brew install --cask kado-so/tap/cin

Windows:

scoop bucket add kado https://github.com/kado-so/scoop-bucket
scoop install kado/cin
winget install Kado.Cin

Any platform with Go:

go install github.com/kado-so/cin/cmd/cin@latest

Put the binary on your PATH.

Quick Start

Create the shared config file at the repo root:

cin init vaishnav

Set root config for an environment:

cin set -e dev options.postgres.host postgres
cin set -e dev options.postgres.port 5432
cin set -e dev extends base

Read without leaking plaintext:

cin get -e dev options.postgres.host

Print plaintext only when needed:

cin get -e dev options.postgres.host --show

Edit the config in a secure temp file:

cin edit

Scope editing when you only want one environment or app:

cin edit -e dev
cin edit -e dev -a api

App Values

App values are injected as environment variables.

cin set -e dev -a api DATABASE_URL 'postgres://{{ .options.postgres.host }}:{{ .options.postgres.port }}/api'
cin set -e dev apps.api.values.REDIS_URL redis://localhost:6379
cin run -e dev -a api -- pnpm dev

Export resolved app config:

cin export -e dev -a api --redact-values
cin export -e dev -a api --format json --stdout --yes

Users

Users are age recipients. New users are pending until an active user approves them and rekeys affected values.

cin users create alice
cin users list
cin users approve alice

Use --age when the public key is already known:

cin users create ci-prod --age age1...

Remove a user and rekey:

cin users remove alice

Files

The default shared file is:

configs.secret.yaml

If this file exists, it is loaded as a local override at highest precedence:

configs.local.secret.yaml

Override or disable local config:

cin run --local-file path/to/local.secret.yaml -e dev -a api -- pnpm dev
cin run --no-local -e dev -a api -- pnpm dev

Environment

cin reads CLI defaults from .env in the current directory and Git root without overriding real process environment variables. Supported keys are CIN_*, EDITOR, HOME, PAGER, and VISUAL.

Useful variables:

CIN_USER=vaishnav
CIN_AGE_KEY=AGE-SECRET-KEY-...

Check Config

cin doctor
cin doctor -e dev -a api
cin explain -e dev -a api DATABASE_URL

Command Groups

Project:

cin init 

Config:

cin set -e  [-a ]  [value]
cin get -e  [-a ] 
cin edit [-e ] [-a ]
cin explain -e  [-a ] 

Runtime:

cin run -e  -a  -- 
cin export -e  -a 

Users:

cin users create 
cin users list
cin users approve 
cin users remove 

Diagnostics:

cin doctor
cin version