Secrets

Sensitive values you need to reference within a durable execution require a two step process; Committing an encrypted file to your durable execution repository and using the the secret module to read at runtime.

The namespace creation response includes a secretsPublicKey value which is used with age to encrypt your file before committing to your repository.

The following example will encrypt a .env file to secret.enc.env using the secrets public key:

cat .env
SECRET_VALUE=private-key

age --encrypt -o secret.enc.env -r <secrets-public-key> .env

The secret.enc.env can now be safely commited to source control and read by your durable execution:

load("secret", "secret")

store = secret.load_store(path = "//secret.enc.env")
store.get("SECRET_VALUE")

Secret files can be dotenv, json and YAML format.