@coffre/cli
The coffre command: secrets in your shell, and a new deployment.
The published CLI runs on Node 20 or newer. Developing coffre from its TypeScript sources and running a deployment require Node 24.
npx @coffre/cli init --workers my-coffre # or --node
npx @coffre/cli setup # its database, keys and, on Workers, Cloudflare
pnpm exec coffre migrate --yes # in a deployment, before its deploy
coffre login https://secrets.acme.example
coffre run market/prod -- node server.js
coffre verify # the instance from outside, the keys you keep, or the log
It bundles everything it runs, so it installs with no dependencies:
setup and migrate bring their own Postgres driver and coffre's
migrations, at the CLI's version. A deployment pins it among its
devDependencies, so its pipeline migrates with the version it deploys.
Each release is also an image, ghcr.io/erwinkn/coffre-cli:<version>,
whose entrypoint is coffre: docker run --rm ghcr.io/erwinkn/coffre-cli:<version> serve …
runs a workload's sidecar
(workloads.md).
Part of coffre, a secrets manager you
deploy as a small project of your own. Its eight @coffre/* packages are
released together, at one version. MIT licensed.