Generating secrets

[domenkozar]

Imagine you want to generate a new wireguard, SSH key, or Postgres password on demand.

We'll likely need to specify a type of secrets here to know what needs to be generated, with generation as a supported feature.

[project]
name = "myproject"
revision = "1.0"

[secrets.default]
MY_SSH_KEY = { description = "...", type = "ssh", generate = true }

[bpottier]

It would also be nice if when using the set flag it also updates the secretspec.toml with the new reference.

[domenkozar]

It would also be nice if when using the set flag it also updates the secretspec.toml with the new reference.

Do you mean like adding new secrets?

[cjshearer]

I'm also curious how SecretSpec will handle applications that are both consumer and producer of their secret (e.g. jwt access / refresh tokens).

It seems like this uses ENV variables to make secrets accessible to applications, which is great for reading, but fundamentally incompatible with an application updating its own secret.

Am I misunderstanding something, or is this truly a limitation of the current method of making secrets accessible to the application?

[domenkozar]

@cjshearer we're still working on the wording here, but ENV variables are there for the transition phase, we want a new application to integrate using Rust SDK.

[bpottier]

It would also be nice if when using the set flag it also updates the secretspec.toml with the new reference.

Do you mean like adding new secrets?

Exactly. Its a little cumbersome having to define the secret in the toml file and then run the set command. It'd be great to just do the set command and it writes the configuration to the toml file.

[domenkozar]

One example where this is needed is #2293 using ${pkgs.openssl}/bin/openssl rand -base64 765 > "$MONGODBDATA/keyfile"

[domenkozar]

4ddd3ca