encrypt_config.py

import os
import sys
import base64
from cryptography.hazmat.primitives.ciphers.aead import AESGCM


def main():
    key_b64 = os.environ.get("AES_KEY", "").strip()
    if not key_b64:
        print("Set AES_KEY=<base64 32-byte key>", file=sys.stderr)
        sys.exit(1)
    if len(sys.argv) < 2:
        print("Usage: AES_KEY=... python encrypt_config.py 'value to encrypt'", file=sys.stderr)
        sys.exit(1)

    key = base64.urlsafe_b64decode(key_b64)
    nonce = os.urandom(12)
    ciphertext = AESGCM(key).encrypt(nonce, sys.argv[1].encode(), None)
    print(f"enc:v1:{base64.urlsafe_b64encode(nonce).decode()}:{base64.urlsafe_b64encode(ciphertext).decode()}")


if __name__ == "__main__":
    main()