Thanks, the fix works!
I am looking forward to the examples!
benonymus
hst337
How did you configure your app?
SecretVault doesn’t interact with passwords and values in the config.exs, it uses it’s own storage inside priv directory. To set password in the application env for database you can just write something like
password = SecretVault.read(config, "db_password")
ecto_config =
:ecto
|> Application.get_env(Repo, [])
|> Keyword.put(:password, password)
Application.put_env(:ecto, Repo, ecto_config)
0
benonymus
Would I do this in the Application start/2?
I tried to read in the config/runtime file from the vault, in essence replace System.get_env
EDIT:
Yes works in start
0
hst337
benonymus
Is it possible to change the config for other applications?
In case we have our application and configure others from deps.
For example here:
config :xxxx,
application_id: System.get_env("APP_ID"),
api_key: System.get_env("API_KEY"),
search_api_key: System.get_env("SEARCH_API_KEY"),
batch_size: 500,
recv_timeout: 5000
Is getting and setting one by one the best option?
If the application (mine should be ok, but the other) were to crash and restart will the config still be ok?
0
hst337
Yes, just like I’ve showed above
For existing dependencies, yes. If you’re writing your own, you can use one of SecretVault.Storage functions to store secrets in env or persistent_term for example.
Applications do not restart by default. When any included application crashes, VM writes erl_crash.dump and stops.
1
benonymus
Would it be possible to call SecretVault from runtime.exs? I tried it, but it always returns the default empty string.
0
hst337
$ bat config/runtime.exs
import Config
{:ok, config} = SecretVault.Config.fetch_from_current_env(:playground)
password = SecretVault.fetch!(config, "database_password")
config :playground, :key, password
$ bat config/config.exs
import Config
config :playground, :secret_vault,
default: [password: "password"]
$ iex -S mix
Erlang/OTP 24 [erts-12.3.2.5] [source] [64-bit] [smp:8:8] [ds:8:8:10] [async-threads:1] [jit]
Interactive Elixir (1.14.2) - press Ctrl+C to exit (type h() ENTER for help)
iex(1)> Application.get_all_env(:playground)
[
key: "My Super Secret Password",
secret_vault: [default: [password: "password"]]
]
1
benonymus
If I want to use SecretVault in runtime.exs, do I need to somehow include the files that I generated for the env in the release?
When I try to release I am getting this error:
** (MatchError) no match of right hand side value: {:error, {:no_configuration_for_app, :xxx}}
It comes from the line where I do
{:ok, config} = SecretVault.Config.fetch_from_current_env(:xxx)
in runtime.exs.
Edit:
I see this error comes when there is no :secret_vault config.
I have it in my config.exs:
config :xxx, :secret_vault, default: [password: System.fetch_env!("SECRET_VAULT_PASSWORD")]
The SECRET_VAULT_PASSWORD env var is available.
I did some logging, if I get the secret_vault env in runtime.exs it returns nil even thought in config.exs it is ok.
Any idea why this might happen?
1
hst337
I can’t reproduce this.
Check this repository for an example: GitHub - hissssst/secret_vault_example: Example of secret_vault usage · GitHub
0