Configuration

Configuration

dbgov stores reusable database contexts and uses opskit-core credential backends for secrets.

Contexts

dbgov ctx set <name> --engine mysql|postgres --host <host> --port <port> \
  --database <db> --username <user> [--env <env>] [--protected] --dry-run -o json
dbgov ctx set <name> --engine mysql|postgres --host <host> --port <port> \
  --database <db> --username <user> [--env <env>] [--protected] \
  --ticket <human-ticket> --allow-context-change --yes
dbgov ctx use <name> --dry-run -o json
dbgov ctx use <name> --ticket <human-ticket> --allow-context-change --yes
dbgov ctx list -o json
dbgov ctx current -o json

Use --protected for production. Protected contexts raise every operation one risk tier.

Credentials

For non-interactive runs, prefer the environment variable:

export DBGOV_PASSWORD='***'

To persist a credential, use a non-plain backend:

dbgov ctx set prod --engine mysql --host db.example.com --port 3306 \
  --database app --username appuser \
  --credential-backend keychain --password '<secret>' \
  --ticket <human-ticket> --allow-context-change --yes

Plain YAML password storage is rejected for new ctx set --password flows. Legacy inline credentials remain readable for migration and export compatibility.

Portable Contexts

dbgov ctx export prod -o json
dbgov ctx import -f ctx.yaml --rename prod-copy --force --dry-run -o json
dbgov ctx import -f ctx.yaml --rename prod-copy --force --ticket <human-ticket> --allow-context-change --yes -o json
dbgov ctx migrate-credentials --to encrypted-file --context prod --dry-run -o json
dbgov ctx migrate-credentials --to encrypted-file --context prod --ticket <human-ticket> --allow-context-change --yes -o json

Context export redacts credentials unless explicitly requested.