Overview
A secret is a value kept encrypted — a password, an API key, a token. Apps get it as an environment variable; it never appears in responses, logs or events.
When to use it
- An API key for a payment provider.
- A database password.
- A token EnclaveStack itself uses, like a DNS provider’s.
How it works
- AES-256-GCM
- Values are encrypted with the machine’s master key, which never leaves the machine.
- Audited reveal
- Reading a value is a separate call that needs edit rights and is recorded in the audit log.
The control plane decrypts a secret only to hand it to a container at start. Changing a secret takes effect on the next deploy of the apps that use it.
Architecture
- You to Encrypted store: set value
- Encrypted store to App container: at start
Flows
Rotating a key
- Update the secret.
- Redeploy the apps that use it.
- They start with the new value.
Set it up
In the console
- Open Secrets and choose New secret.
- Name it and paste the value.
- In an app, add an environment variable from it.
With the CLI
enclave secret create stripe-key --value sk_test_123 --waitWith OpenTofu
OpenTofu configuration
resource "enclave_secret" "stripe_key" {
name = "stripe-key"
value = var.stripe_key
}Settings reference
Every setting and output of the OpenTofu resource; the console and the CLI use the same names in their own words. Generated from platform 4d30582.
| Name | Type | Use | What it does |
|---|---|---|---|
name | text | required | Name of the secret: 3–40 lowercase letters, digits or hyphens, starting with a letter. Changing it replaces the secret. |
project | text | optional | The project to create it in. Defaults to the provider's project (ENCLAVE_PROJECT, else default). Changing it replaces the resource. |
source | list of objects | optional | Read the value from a secret store of the project, and keep it in sync. |
value | text | optional | The secret value (1 byte – 64 KiB). Changes in place. Exactly one of value and source. |
id | text | output | Resource ID. |
synced_at | text | output | When a synced secret was last read from its store. |
version | number | output | Increments each time the value changes. |
Limits and security
Good to know
- Secrets made for databases and other services are managed for you.
Security
- Never in API responses, logs or events; every reveal is audited.