Secrets
Set, generate and delete vault secrets and reference them from harthelm.yml.
Passwords, tokens and keys belong in the workspace's vault, not in harthelm.yml and not in plain environment
variables. A value in the vault is stored encrypted, never shown again, and given only to the services that name it.
Reference a secret
Name the vault key in a service's env:
services:
api:
type: steps
steps: [{run: ./api}]
env:
STRIPE_KEY: ${{ secrets.STRIPE_KEY }}
SESSION_SECRET: ${{ secrets.SESSION_SECRET }}A managed service names its own secrets the same way, exactly one ${{ secrets.K }} each; see
Add a database.
Prepare and test never see secrets. Neither do terminals.
Give it a value
Sync. When the file names a key without a value, the review says so; click Enter secrets and, for each key, type a value and click Save, or click Generate for a random 32-character value. Then Sync.
When every key has a value, the same step is optional: it lists the keys as "Has a value in the vault", and Replace sets a new value.
hart never takes a secret value as a command-line argument and never prints one.
See what is there
hart secret keyshart secret keys lists the keys and their revisions, never the values.
Change a value
Set it again, then Sync: a service keeps the value it got at its last Sync until the next one. The pods of the services that use the key restart with the new value.
Delete a secret
hart secret delete STRIPE_KEYA service that still references the key fails its next Sync until you set it again or remove the reference.
Secrets and env vars
| Workspace env vars | Secrets | |
|---|---|---|
| Who can read them | everyone who can open the workspace | nobody, once set |
| Terminals, prepare, test | yes | no |
| Services | all, after a Sync | only those whose env names them, after a Sync |
In harthelm.yml | ${{ env.K }} | ${{ secrets.K }} |