ops-env

When ops deploys a service it renders the service's secret group into one env file and mounts it in the container at /run/secrets/<name>, with the name in ENV_SECRET. Ops never puts those variables into the process environment itself. @syncronet/ops-env reads that file into process.env before your app starts, on Node 22 or newer and on Bun, with no runtime dependency.

Install

The package is on the ops npm registry. Add the registry to the app's .npmrc, with a token that may read packages:

@syncronet:registry=https://ops.syncronet.dev/npm/
//ops.syncronet.dev/npm/:_authToken=${OPS_NPM_TOKEN}

pnpm add @syncronet/ops-env

The smallest setup

Preload it, so the variables are in place before the first line of your app runs:

node --import @syncronet/ops-env/register server.js
bun --preload @syncronet/ops-env/register server.ts

Or call it first thing in your own entry file:

import { load } from '@syncronet/ops-env'

load()

On your machine, with no ENV_SECRET, the same call reads .env from the working directory, so the code is the same in both places.

• Loading: what load() reads, what wins, and when it stops the process.
• Nuxt and Nitro: why a Nuxt server needs the preload, and how to ship it.
• The file format: what a line may hold, and why $ is never expanded.