README

Cross-platform PHP CLI for Mojo's Infisical secrets management.

🚀 Installation

Global Installation (Recommended)

composer global require mojo/cli
export PATH="$PATH:$HOME/.composer/vendor/bin"

Update Package

# Update to latest version
composer global update mojo/cli

# Check current version
composer global show mojo/cli

# Force reinstall if needed
composer global remove mojo/cli
composer global require mojo/cli

Local Installation

git clone this-repo
cd mojo-cli
composer install

🔧 One-Time Setup (Permanent)

Set Environment Variables

Bash users:

# Add to .bashrc permanently
echo 'export INFISICAL_CLIENT_ID="your-client-id"' >> ~/.bashrc
echo 'export INFISICAL_CLIENT_SECRET="your-client-secret"' >> ~/.bashrc

# Reload .bashrc in current session
source ~/.bashrc

# Verify variables are saved in .bashrc
grep "INFISICAL" ~/.bashrc

Zsh users:

# Add to .zshrc permanently
echo 'export INFISICAL_CLIENT_ID="your-client-id"' >> ~/.zshrc
echo 'export INFISICAL_CLIENT_SECRET="your-client-secret"' >> ~/.zshrc

# Reload .zshrc in current session
source ~/.zshrc

# Verify variables are saved in .zshrc
grep "INFISICAL" ~/.zshrc

Manual setup:

# Edit your shell profile
vim ~/.bashrc  # or ~/.zshrc

# Add these lines:
export INFISICAL_CLIENT_ID="your-client-id"
export INFISICAL_CLIENT_SECRET="your-client-secret"

# Save and reload
source ~/.bashrc

Verify Setup

# Check variables are loaded in current session
echo $INFISICAL_CLIENT_ID
echo $INFISICAL_CLIENT_SECRET

# Check variables are saved in shell profile
grep "INFISICAL" ~/.zshrc     # For Zsh users
grep "INFISICAL" ~/.bashrc    # For Bash users

# Verify variables persist in new terminal
# (Open a new terminal and run):
echo "Client ID: $INFISICAL_CLIENT_ID"

📋 Commands

Initialize Project

# Interactive environment selection
mojocli init --name="Project Name"

# Specify environment directly
mojocli init --name="Project Name" --env="dev"
mojocli init --name="Project Name" --env="staging"
mojocli init --name="Project Name" --env="prod"

Creates infisical.json in current directory.

Fetch Secrets (Pull)

# Interactive environment selection with custom output
mojocli pull --output=.env.local

# Specify environment and output file
mojocli pull --env=dev --output=.env.local
mojocli pull --env=staging --output=.env.staging
mojocli pull --env=prod --output=.env.prod

# Export to shell
export $(cat .env.local | xargs)

# Pull directly to .env file
mojocli pull --env=dev --output=.env

Push Secrets

# Edit .env with your secrets first
vim .env

# Push to Infisical with environment selection
mojocli push --env=dev
mojocli push --env=staging
mojocli push --env=prod

# Interactive environment selection (if no --env specified)
mojocli push

Help

mojocli help

🔄 Complete Workflow

Project Setup

# Initialize project with specific environment
mojocli init --name="My Awesome Project" --env="dev"

# Fetch secrets for development
mojocli pull --env=dev --output=.env.local

# Export to current shell
export $(cat .env.local | xargs)

Development

# Edit secrets locally
vim .env

# Push changes to Infisical
mojocli push --env=dev

# Fetch latest secrets
mojocli pull --env=dev --output=.env.local

Multi-Environment Setup

# Initialize project
mojocli init --name="My Project" --env="dev"

# Fetch secrets for different environments
mojocli pull --env=dev --output=.env.dev
mojocli pull --env=staging --output=.env.staging
mojocli pull --env=prod --output=.env.prod

# Use appropriate environment file
export $(cat .env.dev | xargs)      # For development
export $(cat .env.staging | xargs)  # For staging
export $(cat .env.prod | xargs)     # For production

🛠️ Local Development

Test Commands

# Test help
php bin/mojocli help

# Test init with environment
php bin/mojocli init --name="Test Project" --env="dev"

# Test fetch with environment
php bin/mojocli pull --env=dev --output=.env.local

# Test push
php bin/mojocli push --env=dev

🏗️ Configuration

Files Created

infisical.json - Project configuration (safe to commit)
.env.local - Fetched secrets (add to .gitignore)
.env - Local secrets for pushing (add to .gitignore)

Environment Variables Required

INFISICAL_CLIENT_ID - Your Infisical client ID
INFISICAL_CLIENT_SECRET - Your Infisical client secret

Environment Selection

The tool supports three environments:

dev (development) - Default
staging - For staging environment
prod (production) - For production environment

Environment can be specified via --env parameter or selected interactively.

Supported environment values:

CLI accepts: dev, development, staging, stage, prod, production
API uses: dev, staging, prod (automatically normalized)

Hardcoded Settings

API URL: https://secret.mojomosaic.com (same for all environments)

🔒 Security Notes

Never commit .env or .env.local files
Set environment variables in your shell profile, not in code
Use different client credentials for different environments
Rotate credentials regularly
Environment variables must be set before running any commands

🐛 Troubleshooting

Authentication Errors

# Error: INFISICAL_CLIENT_ID and INFISICAL_CLIENT_SECRET must be set

# Temporary fix (current session only):
export INFISICAL_CLIENT_ID="your-actual-client-id"
export INFISICAL_CLIENT_SECRET="your-actual-client-secret"

# Permanent fix (add to shell profile):
echo 'export INFISICAL_CLIENT_ID="your-actual-client-id"' >> ~/.zshrc
echo 'export INFISICAL_CLIENT_SECRET="your-actual-client-secret"' >> ~/.zshrc
source ~/.zshrc

# Verify they're saved:
grep "INFISICAL" ~/.zshrc

Environment Variables Not Loaded

# Reload your shell profile
source ~/.zshrc    # or ~/.bashrc

# Or restart your terminal

Invalid Credentials (401 Error)

Verify your credentials are correct
Check that environment variables are properly set: echo $INFISICAL_CLIENT_ID
Ensure no truncated values in your shell profile

Windows-Specific Issues

Command Not Found on Windows

# Error: 'mojocli' is not recognized as the name of a cmdlet

# Check if Composer bin directory is in PATH:
echo $env:PATH

# Find Composer global bin directory:
composer global config bin-dir --absolute

# Add to PATH (typical path):
# Add C:\Users\YourUsername\AppData\Roaming\Composer\vendor\bin to system PATH

# Alternative: Run directly with full path:
C:\Users\YourUsername\AppData\Roaming\Composer\vendor\bin\mojocli help

# Restart PowerShell after updating PATH

Windows Environment Variables

# Set environment variables in PowerShell:
$env:INFISICAL_CLIENT_ID = "your-client-id"
$env:INFISICAL_CLIENT_SECRET = "your-client-secret"

# For permanent setup, add to Windows Environment Variables via:
# System Properties > Advanced > Environment Variables
# Or use PowerShell profile:
notepad $PROFILE
# Add the export commands above to your PowerShell profile

SSL Certificate Issues

Self-Hosted Infisical Instances

# Error: SSL certificate problem: unable to get local issuer certificate
# Error: cURL error: SSL certificate problem

# Quick fix - Bypass SSL verification (less secure):
export CURL_INSECURE=1
# Windows PowerShell:
$env:CURL_INSECURE = "1"

# Then retry your command:
mojocli init --name="Project Name"

SSL Certificate Solutions

Option 1: Update CA Certificates (Recommended)

# Download latest CA bundle:
curl -o cacert.pem https://curl.se/ca/cacert.pem

# Set CA bundle path:
export CURL_CA_BUNDLE="/path/to/cacert.pem"
# Windows:
$env:CURL_CA_BUNDLE = "C:\path\to\cacert.pem"

Option 2: Configure for Self-Hosted HTTP

# If your instance uses HTTP instead of HTTPS:
export INFISICAL_URL="http://your-infisical-domain.com"
# Windows:
$env:INFISICAL_URL = "http://your-infisical-domain.com"

Option 3: Add Self-Signed Certificate (Windows)

Visit your Infisical instance in browser
Click the padlock → Certificate → Details → Copy to File
Save as .cer file
Double-click the .cer file → Install Certificate
Choose "Local Machine" → "Trusted Root Certification Authorities"
Restart your terminal

Option 4: Use Official Infisical CLI

# Install official CLI (better SSL handling):
npm install -g @infisical/cli

# Login to self-hosted instance:
infisical login --domain=your-infisical-domain.com

Network and Connectivity Issues

Proxy/Corporate Network

# If behind corporate proxy:
export HTTP_PROXY="http://proxy.company.com:8080"
export HTTPS_PROXY="http://proxy.company.com:8080"
# Windows:
$env:HTTP_PROXY = "http://proxy.company.com:8080"
$env:HTTPS_PROXY = "http://proxy.company.com:8080"

Firewall Issues

Ensure outbound HTTPS (443) access to your Infisical instance
Check if your network blocks external API calls
Contact IT if corporate firewall blocks connections

Debug Mode

# Enable verbose output for debugging:
export DEBUG=1
# Windows:
$env:DEBUG = "1"

# Then run your command to see detailed error information
mojocli init --name="Project Name"

📄 License

MIT

mojo / cli

Maintainers

Details