# Environment files in Vault

Store each environment file as one private Vault entry. The file contents, comments and formatting are preserved. These examples use `dreamlake/envs/dev-env` for development and `dreamlake/envs/prod-env` for production.

## Upload

Use a signed-in DreamLake CLI. Run these commands from the directory containing your environment files; replace `.env.dev` and `.env.prod` with your actual filenames.

```bash
# Development
dreamlake vault add --name dreamlake/envs/dev-env --file-name .env --stdin < .env.dev

# Production
dreamlake vault add --name dreamlake/envs/prod-env --file-name .env --stdin < .env.prod
```

`--stdin` reads the complete file without putting its contents in command arguments. `--file-name .env` saves a suggested filename; it does not create a local file. The Vault path and local filename are independent. Dots in Vault selectors identify fields, so the entry names use `dev-env` and `prod-env` rather than `dev.env` and `prod.env`.

Inspect metadata without printing secret values:

```bash
dreamlake vault show --name dreamlake/envs/dev-env
dreamlake vault show --name dreamlake/envs/prod-env
```

## Replace an existing entry

Read its current revision with `show`, then supply that revision explicitly:

```bash
dreamlake vault add --name dreamlake/envs/dev-env --if-match <revision> --file-name .env --stdin < .env.dev
```

Replace `<revision>` with the returned number. A revision mismatch means the entry changed; inspect it before trying again. Use the production path and file to update production.

## Restore

In the destination project directory, run this Python 3 snippet. It fetches the development file without printing its values, creates `.env` with owner-only permissions, and refuses to overwrite an existing file. Retrieval must succeed before the file is created.

```python
import os
import subprocess

data = subprocess.check_output([
    "dreamlake", "vault", "get", "--name", "dreamlake/envs/dev-env"
])
fd = os.open(".env", os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
with os.fdopen(fd, "wb") as f:
    f.write(data)
print("Restored .env")
```

For production, change the Vault path to `dreamlake/envs/prod-env`. Keep restored files ignored by Git and let your application's usual dotenv loader read them.

Saving a file in Vault does not load it into your shell or deliver it to a remote run. `vault get --to-envs` on a whole-file entry exports one string; it does not parse dotenv lines into separate variables.

CLI syntax checked with DreamLake `0.23.0`. This guide does not upload any files automatically.