We need a more compact way to specify many secrets in many profiles

[btkostner]

First off, thank you for making this. I know it's early days but it's already going to save a ton of work from our current mise env-pull that runs op command setup we have going right now, especially with profiles that can clean up our environments, ci, etc.

We are looking at implementing this in one of our projects that has 87 secrets and at least 5 different profiles (environments.) The current way to specify profiles requires you to re-iterate all of the secrets every time which is very verbose for us. It would be awesome if there was a way to set up a list of secrets in the default profile and have each profile inherit them but change the provider settings.

I haven't thought of how the syntax for this would work yet, but my first thought would be an include or exclude option under the profile:

default_provider = "1password"

[providers."1password"]
type = "1password"
vault = "Development"

[secrets."MY_SECRET"]
provider = "1password"
description = "My super secret secret"
value = "server repository/MY_SECRET"

# ... 86 more secret blocks

[profiles.production]
exclude = [] # new
include = ["*"] # new

[profiles.production.providers."1password"]
type = "1password"
vault = "Production" # A different vault that causes the secrets to change

# Not having to respecify all of the secrets

[jdx]

It would be awesome if there was a way to set up a list of secrets in the default profile and have each profile inherit them but change the provider settings.

I thought you could do this, does it not work?

[smithjw]

I don't believe this inheritance works (though it would be amazing if it did). As an example, I have this fnox.toml file:

[profiles.dev.providers.keychain]
type = "keychain"
service = "fnox_dev"

[profiles.dev.secrets.CLIENT_ID]
provider = "keychain"
if_missing = "ignore"
value = "CLIENT_ID"

[profiles.dev.secrets.CLIENT_SECRET]
provider = "keychain"
if_missing = "ignore"
value = "CLIENT_SECRET"

[profiles.staging.providers.keychain]
type = "keychain"
service = "fnox_staging"

[profiles.staging.secrets.CLIENT_ID]
provider = "keychain"
value = "CLIENT_ID"

[profiles.staging.secrets.CLIENT_SECRET]
provider = "keychain"
value = "CLIENT_SECRET"

[profiles.prod.providers.keychain]
type = "keychain"
service = "fnox_prod"

[profiles.prod.secrets.CLIENT_ID]
provider = "keychain"
value = "CLIENT_ID"

[profiles.prod.secrets.CLIENT_SECRET]
provider = "keychain"
value = "CLIENT_SECRET"

And within my Keychain, I see the 6 corresponding entries which can be accessed successfully via fnox get CLIENT_ID --profile swapping out dev, staging, or prod

There's a lot of duplication in this config because the only thing that is changing is the profile which points to a different iteration of the keychain provider. Would it be possible to have fnox recognise a config file along the lines of this:

[providers.keychain]
type = "keychain"
service = "fnox_default"

[profiles.dev.providers.keychain]
type = "keychain"
service = "fnox_dev"

[profiles.staging.providers.keychain]
type = "keychain"
service = "fnox_staging"

[profiles.prod.providers.keychain]
type = "keychain"
service = "fnox_prod"

[secrets.CLIENT_ID]
if_missing = "ignore"
value = "CLIENT_ID"

[secrets.CLIENT_SECRET]
if_missing = "ignore"
value = "CLIENT_SECRET"

The end-state would mean that by default, fnox get CLIENT_ID would pull the value from items in the keychain with fnox_default, and if --profile is used, would grab those values instead.