import Link from "next/link";
/* ------------------------------------------------------------------ */
/* SVG Icons (inline to avoid extra deps) */
/* ------------------------------------------------------------------ */
const ShieldIcon = () => (
);
const TerminalIcon = () => (
);
const BoltIcon = () => (
);
const ClockIcon = () => (
);
const UsersIcon = () => (
);
const EyeSlashIcon = () => (
);
const DiffIcon = () => (
);
const ServerIcon = () => (
);
/* ------------------------------------------------------------------ */
/* Reusable tiny components */
/* ------------------------------------------------------------------ */
function Badge({ children }: { children: React.ReactNode }) {
return (
{children}
);
}
function SectionHeading({ badge, title, subtitle }: { badge: string; title: string; subtitle: string }) {
return (
{/* ───── Ambient glow blobs ───── */}
{/* ═══════════════════════════════════════════════════════════ */}
{/* NAV */}
{/* ═══════════════════════════════════════════════════════════ */}
{/* ═══════════════════════════════════════════════════════════ */}
{/* HERO */}
{/* ═══════════════════════════════════════════════════════════ */}
🚧 Under Development
Git for your .env files
Stop sending secrets over Slack. EnvSync gives your team a single{" "}
encrypted source of truth for environment variables
— with diffing, versioning, and real-time notifications.{" "}
100% self-hosted.
Star on GitHub
$ npm install -g envsync-cli
{/* Hero terminal preview */}
Terminal — envsync
{cliLines.map((line, i) =>
line.prompt ? (
❯
{line.text}
) : (
{line.text}
),
)}
❯
▊
{/* ═══════════════════════════════════════════════════════════ */}
{/* PROBLEM */}
{/* ═══════════════════════════════════════════════════════════ */}
The Problem
Every dev team has this conversation
@alice: {" "}
Hey did you add the new STRIPE_WEBHOOK_SECRET to your .env?
@bob: {" "}
Wait there's a new one? Since when?
Environment variable drift causes bugs that are impossible to reproduce, broken local setups,
and secrets leaking through Slack DMs.{" "}
EnvSync fixes this — and keeps everything on
your own infrastructure.
{/* ═══════════════════════════════════════════════════════════ */}
{/* FEATURES */}
{/* ═══════════════════════════════════════════════════════════ */}
{features.map((f, i) => (
{f.icon}
{f.title}
{f.desc}
))}
{/* ═══════════════════════════════════════════════════════════ */}
{/* CLI */}
{/* ═══════════════════════════════════════════════════════════ */}
{/* Left – command list */}
{[
{ cmd: "envsync init --project my-app --env dev", desc: "Initialize a vault for your project" },
{ cmd: "envsync push", desc: "Encrypt & push local .env to the vault" },
{ cmd: "envsync pull", desc: "Pull latest secrets from the vault" },
{ cmd: "envsync diff", desc: "See what changed between local & remote" },
{ cmd: "envsync log", desc: "View full audit log for the vault" },
{ cmd: "envsync rollback --version 12", desc: "Restore a previous vault version" },
{ cmd: "envsync set KEY \"value\"", desc: "Set a single variable remotely" },
{ cmd: "envsync envs", desc: "List all environments" },
].map((item, i) => (
{item.cmd}
{item.desc}
))}
{/* Right – tall terminal */}
zsh — envsync diff
❯ envsync diff
Comparing local .env ↔ vault (v14)
+ STRIPE_WEBHOOK_SECRET=whsec_●●●●●●●●
+ FEATURE_FLAG_V2=true
~ DATABASE_URL=postgres://...→...prod
- DEPRECATED_API_KEY
NEXT_PUBLIC_URL=https://app.example.com
REDIS_URL=redis://cache:6379
3 added · 1 modified · 1 removed · 2 unchanged
❯ envsync pull
✓ Pulled vault v14 → .env (4 changes applied)
❯
▊
{/* ═══════════════════════════════════════════════════════════ */}
{/* ARCHITECTURE */}
{/* ═══════════════════════════════════════════════════════════ */}
{archNodes.map((node, i) => (
))}
{/* Connection hint */}
All services connected via Docker internal network · TLS terminated at NGINX
{/* ═══════════════════════════════════════════════════════════ */}
{/* TECH STACK */}
{/* ═══════════════════════════════════════════════════════════ */}
Layer
Technology
Detail
{techStack.map((row, i) => (
{row.layer}
{row.tech}
{row.detail}
))}
{/* ═══════════════════════════════════════════════════════════ */}
{/* SECURITY */}
{/* ═══════════════════════════════════════════════════════════ */}
{[
{ step: "01", title: "Key derivation", desc: "Password → secret key via Argon2id (memory-hard KDF)" },
{ step: "02", title: "Client-side encrypt", desc: "XChaCha20-Poly1305 encrypts your .env before upload" },
{ step: "03", title: "Server stores ciphertext", desc: "PostgreSQL only ever sees encrypted blobs — zero knowledge" },
{ step: "04", title: "Team sharing", desc: "Vault key wrapped with each member's public key (asymmetric)" },
].map((s, i) => (
{s.step}
{s.title}
{s.desc}
))}
{/* ═══════════════════════════════════════════════════════════ */}
{/* GETTING STARTED CTA */}
{/* ═══════════════════════════════════════════════════════════ */}
Ready to stop the .env chaos ?
Get up and running in under 5 minutes. Clone the repo, run Docker Compose, and your whole team
has a single encrypted source of truth.
$ git clone https://github.com/yourusername/envsync.git
$ cd envsync && docker compose up -d
# PostgreSQL, Redis, MinIO, Keycloak, NGINX — all running ✓
View on GitHub
Try the Dashboard
{/* ═══════════════════════════════════════════════════════════ */}
{/* FOOTER */}
{/* ═══════════════════════════════════════════════════════════ */}
);
}