The Inverse of `.gitignore`: How Losing a `.env` Turned Into safekeep
The incident It started, as most of these things do, with a .env . I was mid-refactor, needed a key I was sure I'd written down, and the file wasn't there. Not "stale" — gone . Deleted in a cleanup pass I did at 1am, along with a .local.json and a couple of notes I'd been keeping next to the code. The saving grace was a manual backup — a tarball I'd thrown onto an external disk "just in case"…
The story began with a .env file, a crucial piece of information I needed for a mid-refactor project. However, during a cleanup pass at 1am, I realized the file was missing, along with a .local.json and some notes. Thankfully, I had a manual backup on an external disk, but the incident highlighted a larger issue. My source code had three remotes and a CI pipeline, yet my secrets were unprotected.
The solution I devised was to flip the polarity of .gitignore and create a .sync file at the root of a project, listing what should be copied to backup instead of ignored by git. This simple concept allows for a more comprehensive safeguarding of files, such as API keys or production configurations, which should never enter the repository history.
The .sync file uses a similar syntax to .gitignore, with bare patterns, and exclamation marks to negate rules. By default, backup destinations are stored in ~/.safekeep, and projects can have their own .sync files in ~/.safekeep. The system is designed to be lightweight, with no additional dependencies and a simple configuration.
It uses fswatch to monitor filesystem events and copy files when changes occur, ensuring atomic copies and preventing data loss. The primary use cases for .sync include .env files, TLS certificates, editor configurations, runbooks, and .vault directories. To get started, one can install safekeep using pipx or pip, set up fswatch on macOS or Linux, and create a .sync file in the project root to define what should be backed up.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
