secrets_example.ctst

// Secret injection patterns.
//
// Secrets are referenced with ${secret.name} and resolved at deploy time.
// Resolution order:
//   1. Host environment variable: CONTAINUST_SECRET_<NAME> (uppercased)
//   2. Secret file: /run/containust/secrets/<name> (mode 0400)
//   3. If neither exists, deployment fails with an actionable error.
//
// Secrets are NEVER written to state.json or logged.

COMPONENT api {
    image    = "file:///opt/images/myapp-api"
    port     = 8080
    memory   = "256MiB"
    readonly = true
    env      = {
        DATABASE_URL   = "postgres://${db.host}:${db.port}/app"
        JWT_SECRET     = "${secret.jwt_signing_key}"
        STRIPE_API_KEY = "${secret.stripe_key}"
    }
    restart = "on-failure"
}

COMPONENT db {
    image    = "file:///opt/images/postgres-16"
    port     = 5432
    memory   = "512MiB"
    volume   = "/data/secrets-demo:/var/lib/postgresql/data"
    readonly = false
    env      = {
        POSTGRES_PASSWORD = "${secret.db_password}"
    }
}

// TLS termination proxy with certificate and key from secrets.
COMPONENT tls_proxy {
    image    = "file:///opt/images/nginx-1.25"
    port     = 443
    memory   = "64MiB"
    readonly = true
    restart  = "always"
    env      = {
        TLS_CERT_PEM = "${secret.tls_cert}"
        TLS_KEY_PEM  = "${secret.tls_key}"
    }
}

CONNECT tls_proxy -> api
CONNECT api       -> db

EXPOSE 443