Confy-Tee

Confy-Tee gathers secrets and settings scattered across a dozen different systems and gets them where they need to go -- reliably, without a wiki page of tribal knowledge.

An ultimate poor-man's best way to do the worst-way configurations, across different systems! Reliably (?).

What it actually does

You write one config -- plain JSON, or TypeScript if you want real typing -- describing two things: where each setting should be read from, and where it should be written to. Run it via npx, no install required: npx -p @incrediblez/confy-tee.common -p @incrediblez/confy-tee run --env=./.env --config=./config.json

Readers and writers are both pluggable -- a reader might pull a value from Auth0 or an Azure CLI session, a writer might drop it into a .env file under a different name. Placeholders ({{LIKE_THIS}}) get swapped in recursively from your environment before anything runs, so one config can flex across dev, staging, and prod without being rewritten each time.

Where it can reach today

Auth0 (OAuth), Azure (both CLI-session and personal-access-token flows), plus a generic "Common" plugin set (hardcoded values, .env file writers) for everything that doesn't need a dedicated integration yet. Every plugin ships as its own npm package and is meant to stand alone -- pull in only the vendor integrations your config actually uses, nothing more.

Why it exists

Two recurring situations drove it: disaster recovery (instead of a runbook telling someone where 30 different settings live and how to refetch them, there's a config that does it), and keeping secrets in sync across many consumers when a proper secrets vault isn't in the budget or isn't wired up to everything yet -- the project's own docs specifically call out a real integration with 30+ settings across internal and external services as the case that made this worth building.

A few rules it holds itself to

Since this is a tool that handles secrets, its own contribution guidelines are opinionated on purpose: no third-party dependency without real justification, official vendor SDKs over anything unofficial, and every plugin bundles its own dependencies rather than sharing a pile with the rest of the ecosystem -- smaller attack surface, on the theory that a tool built to move secrets around should be paranoid about what code gets to touch them.

Where it stands today

Early -- v0.0.2, MIT licensed, Node 18+ and npm 5+. TypeScript throughout. The project's own TODO list is upfront about what's still missing: test coverage, a transform layer for values in flight, and a broader plugin set are all still open.