# noust env

Read and set the environment variables of a deployed application.

```bash
noust env [OPTIONS] COMMAND [ARGS]...
```

Subcommands: [`audience`](#noust-env-audience), [`comment`](#noust-env-comment), [`configure`](#noust-env-configure), [`export`](#noust-env-export), [`mark`](#noust-env-mark), [`migrate`](#noust-env-migrate), [`resolve`](#noust-env-resolve), [`set`](#noust-env-set), [`show`](#noust-env-show), [`sync`](#noust-env-sync), [`unset`](#noust-env-unset)

## noust env audience

Say whether a variable is for the build, the running application, or both.

```bash
noust env audience [OPTIONS] DOMAIN NAME
```

Arguments: `domain`, `name`

| Option | What it does | Default |
|---|---|---|
| `--build-only` | Only the install and the build. |  |
| `--runtime-only` | Not the install or the build. |  |
| `--both` | The build and the running application. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust env comment

Show, set or take away the comment above a variable.

```bash
noust env comment [OPTIONS] DOMAIN NAME [TEXT]
```

Arguments: `domain`, `name`, `text`

| Option | What it does | Default |
|---|---|---|
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust env configure

Ask for each variable the application declares and save its .env.

```bash
noust env configure [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust env export

Write an application's variables to a file, owner-readable only.

```bash
noust env export [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `-o`, `--output` | Where to write the file. | `.env` |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust env mark

Override whether one environment variable is treated as a secret.

```bash
noust env mark [OPTIONS] DOMAIN NAME
```

Arguments: `domain`, `name`

| Option | What it does | Default |
|---|---|---|
| `--secret` | Always treat this variable as a secret. |  |
| `--not-secret` | Never treat this variable as a secret. |  |
| `--auto` | Remove any override and judge this variable by its name and value again. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust env migrate

Move an application's variables from its systemd unit into its .env (units written by 1.x).

```bash
noust env migrate [OPTIONS] [DOMAIN]
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--all` | Every application whose unit still carries variables. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust env resolve

Resolve the references in an application's variables again, without a deploy.

```bash
noust env resolve [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust env set

Add or change variables, keeping the others.

```bash
noust env set [OPTIONS] DOMAIN NAME=VALUE...
```

Arguments: `domain`, `pairs`

| Option | What it does | Default |
|---|---|---|
| `--stdin` | Read NAME=VALUE lines from standard input. |  |
| `--build-only` | Only the install and the build. |  |
| `--runtime-only` | Not the install or the build. |  |
| `--both` | The build and the running application. |  |
| `--file` | Set NAME to the content of the file at PATH (a private key, a certificate, a JSON document): a value of several lines. Repeat it. |  |
| `--comment` | Keep this comment above each variable set here (empty takes the comment away). |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust env show

List the variables an application runs with, secrets hidden.

```bash
noust env show [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--unmask` | Print secret values in clear instead of hiding them. |  |
| `--json` | Print the variables as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust env sync

Bring a real .env file into an application's variables.

```bash
noust env sync [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--file`, `-f` | The .env file to bring in; - reads it from standard input. |  |
| `--prune` | Also remove the variables the file does not hold. Without it nothing is deleted. |  |
| `--build-only` | Only the install and the build. |  |
| `--runtime-only` | Not the install or the build. |  |
| `--both` | The build and the running application. |  |
| `--json` | Print what changed (names, never values) as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust env unset

Remove variables, keeping the others.

```bash
noust env unset [OPTIONS] DOMAIN NAMES...
```

Arguments: `domain`, `names`

| Option | What it does | Default |
|---|---|---|
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |