Env groups

Create a reusable set of environment variables once and attach it to any number of services.

An env group is a reusable set of environment variables you attach to one or more services. On deploy, a group's variables are injected into every attached service. A service's own variables always take precedence, so you can override a shared default for one service.

Create a group#

  1. 1

    Open Env groups

    From the sidebar, open Env groups and click “New group”.

  2. 2

    Add variables

    Add keys and values one at a time, or import a .env file to fill the group in one step.

  3. 3

    Attach to services

    Attach the group to any service that should receive its variables.

Import a .env file#

An import merges by default. Existing keys stay unless the file redefines them, and then the file wins. To drop every key the file does not list, import with replace. Secret variables are kept even then, because nobody can read them back to resubmit them.

Via CLI#

Shell
gheima env-groups create shared
gheima env-groups import grp_123 .env.production
gheima env-groups attach grp_123 my-app
gheima env-groups detach grp_123 my-app
Create a group, import a .env file into it, then attach or detach it from a service (id, name, or slug).

Via API#

Shell
curl -X POST https://api.gheima.ma/v1/env-groups \
  -H "Authorization: Bearer $GHEIMA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name":"shared"}'
Create a group, then PUT /api/v1/env-groups/{id} with a vars object to set its variables, or POST /api/v1/env-groups/{id}/services to attach it.

Precedence & limits#

  • A service's own environment variables always override a value coming from an attached group.
  • When a service has several groups attached, they merge in attach order. On a shared key, the most recently attached group wins.
  • Deleting a group detaches it from every service. The change takes effect on each service's next deploy.
  • The maximum number of env groups on your account is set by your plan.

✦ Your fleet shares config and secrets from one place, instead of copy-pasting the same variables into every service.