release

dotMage 1.3.0 — any file, any server

July 3, 2026

This is the biggest release since 1.0. dotMage stops being an .env-only tool: any config file syncs now, with its name and format encrypted alongside the contents. If you run two servers — one at work, one at home — the CLI now picks the right one from the directory you're standing in, git-style. And the binary updates itself.

Highlights

Store any file

DataGrip datasource XML, kubeconfig, service-account JSON — anything. The file name and format travel inside the encrypted payload, so the server never sees them:

$ dmage init dbconf --file dataSources.xml
  ✓ Created app 'dbconf'. Pushed revision 1 from dataSources.xml (4.2 KB, text).

# on another machine
$ dmage pull dbconf          # recreates dataSources.xml
$ dmage push dbconf          # picks it up automatically

diff adapts to the format, exec politely refuses non-env apps. Existing .env apps are untouched and stay compatible with older CLIs; non-env apps need 1.3 on all devices.

Multiple servers, mapped to directories

Like git's includeIf: map ~/code/work to the office server and ~/code/personal to your homelab, and every command resolves the right server from your CWD — no context switching, no files dropped into your projects:

$ dmage server add work https://secrets.corp.com --path ~/code/work
$ dmage server add personal https://home.example.com --path ~/code/personal

$ cd ~/code/work/billing-api
$ dmage push
  ✓ Pushed revision 5 (12 keys).  → work (secrets.corp.com)

The app name defaults to the directory name, so inside a project dmage push is the whole command. With a single server nothing changes at all.

Self-update

$ dmage upgrade

Downloads the release binary, verifies it against the release's SHA256SUMS, sanity-checks it, and swaps atomically. Homebrew installs are detected and pointed to brew upgrade.

Empty-push guard

Pushing an .env with zero keys — a truncated file, the wrong directory — is now an error instead of a silent secrets wipe. --allow-empty if you really mean it.

Changelog

Added

Store any file, not just .env — file name/format encrypted with the payload; pull/push use the stored name; diff adapts; exec refuses non-env apps.
Multiple servers: dmage server add/map/list/rm/use/rename, global --server <name>, DOTMAGE_SERVER. Directory mappings in the global config; legacy configs migrate automatically.
App name defaults to the current directory name (dmage push with no arguments).
dmage lock --all / dmage logout --all.
dmage upgrade — verified self-update (--check, --version, --force, -y).

Changed

Pushing an empty .env now fails; --allow-empty to override.

Security

Releases ship a SHA256SUMS asset; dmage upgrade refuses releases without it.

Downloads

Binaries and SHA256SUMS: github.com/dotMage/dotmage/releases/tag/v1.3.0

brew upgrade dotmage        # Homebrew
dmage upgrade               # self-update (from 1.3.0 onward)

◂ All posts