jdx/fnox v1.32.0

v1.32.0: Credential proxy, process replacement, and Azure App Configuration

on GitHub

A feature-packed release adding a destination-scoped credential proxy, a process-replacement mode for exec, a new Azure App Configuration provider, and IAM role assumption for the AWS providers, plus a fix to how global config layers under explicit --config paths.

Highlights

• New ways to keep real secrets out of workloads: a credential proxy that brokers HTTPS requests without exposing secret values, and an exec --replace mode for clean environment-only execution.
• Broader cloud coverage: a read-only Azure App Configuration provider and cross-account IAM role assumption in the AWS providers.

Added

Credential proxy (#667) -- @jdx

A new [proxy] configuration and fnox proxy command let agent-style workloads call external APIs without ever receiving real secret values in their environment. fnox runs an ephemeral loopback TLS interception proxy that substitutes credentials into allowed request headers only for destinations that match your rules, and redacts reflected secret values from responses.

fnox proxy rules            # inspect the effective policy
fnox proxy run -- ./agent   # run a command through the local proxy

Rules match on domain, HTTP method, path globs, and headers, with strict (block-by-default) or permissive egress. The child environment is scrubbed of profile secrets and ambient provider credentials, redirects and ambient upstream proxies are blocked, and overlay configs replace [proxy] wholesale so layered rules cannot silently broaden authority. This is an intentionally narrow first pass: OS sandboxing is not yet included (same-user processes can bypass proxy env vars), interception is HTTPS on port 443 over HTTP/1.1, credential substitution is header-only, and responses over 10 MiB are rejected.

fnox exec --replace process replacement mode (#654) -- @davdroman

On Unix-like systems, fnox exec --replace runs your command via process replacement so it keeps the same PID and receives signals directly, instead of fnox staying resident as a parent.

fnox exec --replace -- ./app

Because replacement prevents post-command cleanup, file-based secrets and credential leases are rejected up front. Ambient FNOX_AGE_KEY and FNOX_AGE_KEY_FILE values are omitted while explicitly selected secrets with those names are still passed through, and inherited ignored SIGINT/SIGTERM dispositions are preserved.

Azure App Configuration provider (azure-ac) (#659) -- @jmoreno11

A read-only provider for Azure App Configuration, the non-secret half of Azure's config surface (endpoints, feature toggles, tuning values) that complements the existing azure-sm Key Vault provider. Supports optional label (which maps naturally onto profiles) and prefix, using the same DeveloperToolsCredential auth as azure-sm with no new dependencies. Configure it with your App Configuration endpoint and an optional label:

[profiles.prod.providers]
appconfig = { type = "azure-ac", endpoint = "<your-appconfig-endpoint>", label = "prod" }

IAM role assumption in the AWS providers (#671) -- @halms

aws-sm, aws-ps, and aws-kms now accept an optional role_arn. When set, fnox calls sts:AssumeRole using the credentials from profile (or the default chain) and uses the result for every request — enabling the common "log in with this SSO profile, read secrets as that role" cross-account setup. aws-kms also gains the profile field that the other two already had, and malformed role ARNs are rejected before any AWS call.

[providers.sm]
type = "aws-sm"
region = "eu-west-1"
profile = "sso-dev"
role_arn = "arn:aws:iam::123456789012:role/secrets-reader"

Fixed

• Global config now layers under explicit --config paths (#651) -- @jdx. Previously, pointing -c/--config at anything other than a bare default filename silently skipped the global config and ignored that file's own import = [...], while fnox config-files listed files that were never actually loaded. An explicit path now loads that file, its imports, and the global config underneath it, and fnox config-files reflects the path loading actually takes. Note: fnox -c custom.toml sync -p <provider> can now pull globally-declared secrets into the custom file, consistent with discovered configs. For full isolation, point FNOX_CONFIG_DIR at a directory with no config.toml.

New Contributors

• @jmoreno11 made their first contribution in #659
• @davdroman made their first contribution in #654
• @halms made their first contribution in #671

Full Changelog: v1.31.1...v1.32.0

💚 Sponsor fnox

fnox is maintained by @jdx, an open source developer for entire.io, the title sponsor of the jdx.dev open source tools including mise, aube, hk, and more. Keeping fnox secure, maintained, and free is funded by sponsors.

If fnox is handling secrets or config for you or your team, please consider sponsoring at jdx.dev. Sponsorships are what let fnox stay independent and the project keep moving.