Environment & secrets
Environment files are versioned, encrypted at rest, and shared across releases.
Where the file lives
Each site's environment file is at shared/.env, owned by the site's account with mode 0600, and installed there at the start of every deploy. Runtimes that expect a .env in the working directory (Laravel, generic PHP, and Node build tools) get a symlink to it inside the release. Swift services read it through their systemd unit. Nginx denies dotfiles, so it is never served over HTTP.
Versions
Saving creates a new version instead of overwriting the previous one. You can read any earlier version, compare it with the current one, and restore it. A restore copies the older contents forward as a new version, so nothing in the history is rewritten and the restore itself can be undone.
Saving does not restart anything. Turn on Redeploy after save to ship the new version now. Otherwise it takes effect on the next deploy.
Editing
The site’s Environment view is the editor. The same reads and writes are available over the REST API. Reading contents needs a token carrying secrets:read.
Access and security
- Contents are encrypted at rest and masked in the app until you reveal them.
- Revealing or editing values requires the admin or owner role and your password again. Both reads and writes appear in the audit log.
- For API tokens the gate is secrets:read, which no other scope grants. A deploy token can ship a release without being able to read the environment file.
- Contents are decrypted for a single response and never appear in deploy logs or job output.
- File backups exclude .env. A restore recreates it from these encrypted versions.