use nix

eval "$(ansible-vault view .env | direnv dotenv bash /dev/stdin)"
watch_file ".env"