Secrets and env files

A secret group holds a service's variables. Each variable is a secret, whose value is never shown again once saved, or text, whose value can be read back.

List

ops secrets list api
ops secrets list api --env staging

Each variable's name, kind, whether it has a value, its version and whether a change is waiting to be rendered. A value is shown for text variables only.

Set

ops secrets set api STRIPE_KEY=sk_live_...        # a secret
ops secrets set api LOG_FORMAT=json --text        # a text variable

A name is A to Z, 0 to 9 and _, starting with a letter, and is checked before anything is sent. The value is split at the first =, so it may hold more. The command prints the name and the group, never the value. --group api works in place of the positional group name.

The kind is decided when the variable is created. Setting an existing variable again changes its value and keeps its kind.

Rotate

ops secrets rotate api

Renders the group again and restarts the services that mount it. It prints the new secret version, the services it restarted and any it skipped, with the reason.

Pull an env file

ops env pull                 # to stdout
ops env pull -o              # to .env
ops env pull -o .env.local --group api --env staging

Text variables are written as NAME=value. Secret values are never exported, anywhere: each secret becomes a comment saying it is rendered into the container at deploy time, so the file is a starting point, not a runnable copy of production. --fail-on-secrets makes the command fail when the group holds any secret.

--group may be left out while the environment has a single secret group. With several, the command names them and asks you to choose.

A database's connection is a secret, so a pulled file names it and holds none of it. Point your own DATABASE_URL at a local database.