bootstrap-fly-env-sync

Bootstrap Fly.io Env Sync Script

Create a script that reads a .env file and converts it into batched fly secrets set commands.

What Gets Created

1. scripts/env-to-fly-secrets.sh — The sync script (from template)
2. .env.prod — Created from .env.sample if it exists and .env.prod doesn't (user fills in real values)
3. .gitignore update — Ensures .env.prod is ignored
4. Justfile recipe (optional) — If a justfile exists, adds a fly-secrets recipe

Features of the Script

• Parses .env files (skips comments, blank lines, handles export prefix)
• Validates keys match [A-Za-z_][A-Za-z0-9_]*
• Strips surrounding quotes from values
• Batches secrets into groups (default 10) to avoid Fly CLI limits
• Dry-run by default — prints commands without executing
• --execute flag to actually run fly secrets set
• Configurable app name (-a) and batch size (-n)

Phase 0: Discovery

Check the target project before creating anything:

1. Existing script — Glob("**/env-to-fly*") or Glob("**/fly-secrets*")

   • If found: show it and ask if user wants to replace

2. Scripts directory — Check if scripts/ exists

   • If not: will create it

3. .env.sample — Check if an env template exists

   • Could be .env.sample, .env.example, or .env.template
   • If found: offer to copy it to .env.prod as a starting point

4. .env.prod — Check if it already exists

   • If found: leave it alone

5. .gitignore — Check if .env.prod is already ignored

   • Grep("\.env\.prod", path: ".gitignore")

6. justfile — Check if a justfile exists for adding a recipe

   • Glob("justfile") or Glob("Justfile")

7. fly.toml — Check if Fly is configured to detect the app name

   • Grep("^app = ", path: "fly.toml")

Discovery Report

Present what will be created/modified and confirm.

Phase 1: Implementation

Step 1: Create Scripts Directory

mkdir -p scripts

Step 2: Create the Script

Read references/script-template.sh and write it to scripts/env-to-fly-secrets.sh.

Make it executable:

chmod +x scripts/env-to-fly-secrets.sh

Step 3: Create .env.prod (if needed)

If .env.sample (or equivalent) exists and .env.prod does not:

• Copy the sample file to .env.prod
• Tell the user to fill in production values

If no sample exists, skip this step.

Step 4: Update .gitignore

Add .env.prod to .gitignore if not already present. Place it near other .env* entries if they exist, otherwise append to the end.

Step 5: Justfile Recipe (if justfile exists)

Add a recipe like:

# Sync .env.prod to Fly secrets (dry-run by default, pass --execute to apply)
fly-secrets *args:
    ./scripts/env-to-fly-secrets.sh -f .env.prod {{args}}

If the app name is known from fly.toml, include -a <app-name>:

fly-secrets *args:
    ./scripts/env-to-fly-secrets.sh -f .env.prod -a <app-name> {{args}}

Phase 2: Verification

1. Run ./scripts/env-to-fly-secrets.sh --help to verify the script works
2. If .env.prod exists with content, do a dry-run: ./scripts/env-to-fly-secrets.sh -f .env.prod to show what would be set

Usage

Tell the user:

# Preview what will be set (dry-run)
./scripts/env-to-fly-secrets.sh -f .env.prod -a my-app

# Actually set the secrets
./scripts/env-to-fly-secrets.sh -f .env.prod -a my-app --execute

# Custom batch size
./scripts/env-to-fly-secrets.sh -f .env.prod -a my-app -n 5 --execute

If justfile was configured:

# Dry-run
just fly-secrets

# Execute
just fly-secrets --execute