Browse the docs
Concepts
Organizations, projects and environments
How Crunu organizes secrets: organizations hold members and projects, projects hold environments, and each environment is a unit of encryption and access.
Last updated
On this page
Crunu organizes secrets in three levels. An organization is your team. It holds projects, one per application or service. Each project holds environments, such as development, staging and production. The environment is where encryption and access happen.
Example. Kiteline is a fictional company. Its organization has three projects:
payments-apiandweb-app, each withdevelopment,stagingandproduction, anddata-pipelinewithdevelopmentandproduction.
Organizations
An organization brings together members, projects, machines, service tokens and the organization keys. One account can belong to several organizations, and the switcher at the top of the sidebar moves between them. Anyone who is signed in can create a new organization and becomes its owner.
The organization owns its signing key and recovery key. Owners and admins hold them, sealed to their own keys. See Roles and How encryption works.
Only an owner can rename an organization, change its settings or delete it. Deleting an organization needs a signature made from the owner's current password and Secret Key, re-entered for that purpose. Machines are revoked, share links stop working, and the data is removed by cleanup.
Projects
A project groups the environments of one application or service. Create one with New project on Projects. The dialog offers dev, stage and prod as checkboxes, with dev and prod selected, and a field for Other environments, separated by commas. A new environment starts with one empty .env file.
Owners and admins create, rename and delete shared projects. An organization holds up to 500 projects.
Your personal project
Every member also has one personal project, named Personal, with an environment called my keys. It's for your own files, such as ~/.aws/credentials or ~/.npmrc. Only you manage it. It isn't shared with the team.
By default, the organization's owners and admins can reach personal environments through the organization recovery key. That lets them help when someone loses access, and move a former member's personal keys to a new account. An owner can turn this off in Organization settings, under Personal environments. Personal environments are then sealed only to their owner's key.
Environments
An environment is the unit of encryption and access. Each one has its own encryption key, so access to dev gives no access to prod. Each has its own access list, its own history and, optionally, its own network rule.
Create one with New environment on the project page. A new environment can start empty, or as a Copy of another environment: its files, paths and notes, but not its share links. With Variable names only, no values, you can start prod from the names in dev without copying any value. A project holds up to 50 environments.
The sidebar and the project cards mark environments by kind with a colored label: dev, stage or prod, worked out from the name. Names like production or live get the prod label, so it's easy to see where you are.
What an environment holds
An environment holds files: .env files, INI files such as ~/.aws/credentials, flat YAML, or any text. Its contents, all files together, can be up to 1 MB. See Files and variables.
Every save creates a new version. The environment keeps the latest 100 versions, up to 64 MB of ciphertext. See Versions and history.
Who can access it
Access is set per environment, directly or through an access profile. Roles on an environment are Editor, Reader, Specific files and Operator. Owners and admins of the organization reach every shared environment without being listed. Up to 5,000 entries fit in one environment's access list.
Renaming and deleting
Environments are renamed, rotated and deleted in Project settings. Deleting asks you to type the environment name. Names are visible to the server as metadata, but they are part of the signed access list, so the server can't rename prod to dev unnoticed.
How the levels map to access
| Level | Who manages it | What access means |
|---|---|---|
| Organization | owners, and admins for most things | organization role: Owner, Admin or Member |
| Project | owners and admins | a container. Access isn't granted per project |
| Environment | owners and admins grant access | an environment role, and a key or a file copy sealed to the recipient |
Machines and service tokens get access to environments the same way, with a delivery method instead of a role. See Machines and leases and Service tokens.