Usage Examples

DigitalOcean

Both DigitalOcean App Platform and bare droplets work cleanly with EnvVault. Set ENVVAULT_TOKEN as the only platform-level secret and let envv run handle the rest.

App Platform

# .do/app.yaml
services:
  - name: web
    github:
      repo: my-org/my-app
      branch: main
    run_command: envv run -e production -- npm start
    envs:
      - key: ENVVAULT_TOKEN
        value: ${ENVVAULT_TOKEN}
        type: SECRET
      - key: ENVVAULT_PROJECT
        value: proj_xxx

Droplet (systemd)

# /etc/systemd/system/my-app.service
[Service]
Environment="ENVVAULT_TOKEN=evk_xxxxxxxxxxxxxxxxx"
Environment="ENVVAULT_PROJECT=proj_xxx"
ExecStart=/usr/local/bin/envv run -e production -- /opt/my-app/server
Restart=on-failure

Lock down the systemd unit with chmod 600 so the token isn't world-readable.

DOCR + Kubernetes

For DigitalOcean Kubernetes, follow the Kubernetes guide — the patterns are identical.