You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/guide/secrets.md
+78Lines changed: 78 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -100,6 +100,81 @@ flow vault create team --type age --recipients key1,key2,key3 --identity-file ~/
100
100
flow vault create team --type age --recipients key1,key2,key3 --identity-env MY_IDENTITY
101
101
```
102
102
103
+
#### **Unencrypted**
104
+
A simple vault that stores secrets in plain text JSON files.
105
+
This is not recommended for production use but can be useful for development or testing.
106
+
107
+
```shell
108
+
# Create an unencrypted vault
109
+
flow vault create dev --type unencrypted
110
+
```
111
+
112
+
113
+
#### **Keyring**
114
+
115
+
A vault that uses your operating system's keyring for managing secrets.
116
+
This is a good option for personal use where you want seamless integration with your OS security.
117
+
118
+
```shell
119
+
# Create a keyring vault
120
+
flow vault create dev --type keyring
121
+
```
122
+
123
+
#### **External (other CLI tools)**
124
+
125
+
An external vault that uses executes an external CLI tool via shell commands to manage secrets.
126
+
This allows you to integrate with existing secret management systems.
127
+
128
+
First you have to define the external vault configuration in JSON format. Here is a sample one that uses the `pass` CLI tool:
129
+
130
+
```json
131
+
{
132
+
"id": "pass",
133
+
"type": "external",
134
+
"external": {
135
+
"get": {
136
+
"cmd": "pass show {{key}}",
137
+
"output": "{{output}}"
138
+
},
139
+
"set": {
140
+
"cmd": "pass insert -e {{key}}",
141
+
"input": "{{value}}"
142
+
},
143
+
"delete": {
144
+
"cmd": "pass rm -f {{key}}"
145
+
},
146
+
"list": {
147
+
"cmd": "pass ls",
148
+
"output": "{{output}}"
149
+
},
150
+
"environment": {
151
+
"PASSWORD_STORE_DIR": "$PASSWORD_STORE_DIR"
152
+
},
153
+
"timeout": "30s"
154
+
}
155
+
}
156
+
```
157
+
158
+
> [!INFO]
159
+
> See the [flowexec/vault examples](https://github.com/flowexec/vault/tree/v0.2.1/examples) for sample configurations for popular CLI tools like Bitwarden, 1Password, AWS SSM, and more.
-`{{value}}` - The secret value (for set operations)
173
+
-`{{env["VariableName"]}}`- Environment variable value
174
+
-`{{output}}` - Raw command output (for output templates)
175
+
176
+
All [Expr language](https://expr-lang.org/docs/language-definition) operators and functions can be used in the command templates, allowing for powerful dynamic secret management.
177
+
103
178
<!-- tabs:end -->
104
179
105
180
#### Authentication
@@ -109,6 +184,9 @@ If you did not provide a key or file, these default environment variables will b
109
184
110
185
- For AES256 vaults: `FLOW_VAULT_KEY` environment variable
111
186
- For Age vaults: `FLOW_VAULT_IDENTITY` environment variable
187
+
- For Unencrypted vaults: no key is needed, it stores secrets in plain text
188
+
- For Keyring vaults: no key is needed, it uses the OS keyring directly
189
+
- For External vaults: no key is needed, it uses the external CLI tool directly. Auth may be required by the tool itself
112
190
113
191
At least one of the key or file will be used. You can configure key storage during vault creation:
0 commit comments