Adding a Secret

Adding a Secret

How to add a new secret for use in container configuration.

🔗 For the full secrets architecture (KeyVault design, SPN setup, naming conventions), see Secrets & Credentials in the nas-as-code wiki.

Quick Steps

1. Add to Azure KeyVault

az keyvault secret set \
  --vault-name <your-vault-name> \
  --name "myapp-api-key" \
  --value "the-actual-secret-value"

2. Reference in .env

In your stack's .env file, add:

MYAPP_API_KEY=#{MYAPP_API_KEY}#

3. Use in docker-compose.yml

environment:
  - API_KEY=${MYAPP_API_KEY}

4. Commit and Push

The .env file (with the token, not the secret) gets committed. The workflow replaces #{MYAPP_API_KEY}# with the real value at deploy time.

Naming Convention

KeyVault Name	Environment Variable	Token in .env
myapp-api-key	MYAPP_API_KEY	#{MYAPP_API_KEY}#
plex-token	PLEX_TOKEN	#{PLEX_TOKEN}#
sonarr-api-key	SONARR_API_KEY	#{SONARR_API_KEY}#

Rule: KeyVault uses lowercase-with-hyphens → workflow converts to UPPERCASE_WITH_UNDERSCORES.

Important Notes

• Never commit actual secret values — only the #{TOKEN}# pattern
• No workflow changes needed — the pipeline dynamically pulls ALL secrets from KeyVault
• Shared across repos — the same KeyVault serves both nas-as-code and this repo
• Rotation — just update the value in KeyVault; next deploy picks it up automatically