Skip to content

Add secret store configuration #216

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
danielgerlag wants to merge 2 commits into
base: main
Choose a base branch
from
+459 −3
Open

Add secret store configuration #216

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
336cecb
secret stores
danielgerlag May 21, 2026
fba633b
fix: add spelling dictionary entries for secret store docs
danielgerlag May 21, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions .github/config/en-custom.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1642,3 +1642,11 @@ Shopify
ns
Handlebars
Stripe
ACI
Hardcoded
IntelliJ
KDE
Keychain
Keyring
keyring
VMs
9 changes: 9 additions & 0 deletions docs/content/drasi-server/how-to-guides/configuration/_index.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,4 +55,13 @@ description: "Step-by-step instructions for configuring Drasi Server"
</div>
</div>
</a>
<a href="configure-secret-stores/">
<div class="unified-card unified-card--howto">
<div class="unified-card-icon"><i class="fas fa-key"></i></div>
<div class="unified-card-content">
<h3 class="unified-card-title">Configure Secret Stores</h3>
<p class="unified-card-summary">Resolve passwords and tokens from external secret stores</p>
</div>
</div>
</a>
</div>
49 changes: 49 additions & 0 deletions ...ntent/drasi-server/how-to-guides/configuration/configure-drasi-server/_index.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,8 @@ related:
url: "/drasi-server/how-to-guides/configuration/configure-reactions/"
- title: "Configure Bootstrap Providers"
url: "/drasi-server/how-to-guides/configuration/configure-bootstrap-providers/"
- title: "Configure Secret Stores"
url: "/drasi-server/how-to-guides/configuration/configure-secret-stores/"
- title: "Install with Docker"
url: "/drasi-server/how-to-guides/installation/install-with-docker/"
reference:
Expand Down Expand Up @@ -99,6 +101,11 @@ stateStore:
kind: redb
path: ./data/state.redb

# Secret store for resolving secret references (optional)
# secretStore:
# kind: file
# path: ./secrets.json

# Performance tuning (optional)
# (if omitted, DrasiLib defaults are used)
defaultPriorityQueueCapacity: 10000
Expand Down Expand Up @@ -146,6 +153,7 @@ Top-level settings in `server.yaml`:
| `persistConfig` | boolean | `true` | Persist API changes back to the config file (if writable) |
| `persistIndex` | boolean | `false` | Enable persistent indexes using RocksDB (stored under `./data/<instanceId>/index`) |
| `stateStore` | object | None | Persist plugin state across restarts (see below) |
| `secretStore` | object | None | Secret store provider for resolving secret references (see below) |
| `defaultPriorityQueueCapacity` | integer | None | Default event queue capacity for queries/reactions (if set, overrides DrasiLib defaults) |
| `defaultDispatchBufferCapacity` | integer | None | Default dispatch buffer capacity for sources/queries (if set, overrides DrasiLib defaults) |
| `sources` | array | `[]` | Source plugin instances (see: Configure Sources) |
Expand Down Expand Up @@ -189,6 +197,43 @@ stateStore:

If `stateStore` is not configured, an in-memory store is used and plugin state is lost on restart.

## Secret Store Configuration

The secret store enables you to keep sensitive values (passwords, API keys, tokens) out of your configuration file. Instead of embedding secrets as plaintext or relying solely on environment variables, you reference named secrets that are resolved at runtime from an external store.

Configure a secret store by adding a `secretStore` field at the top level:

```yaml
secretStore:
kind: file
path: ./secrets.json
```

Then use **secret envelopes** in source or reaction configuration fields:

```yaml
sources:
- kind: postgres
id: my-db
password:
kind: Secret
name: DB_PASSWORD # resolved from the secret store at runtime
```

Three providers are available:

| Provider | `kind` | Use case |
|----------|--------|----------|
| File | `file` | Development/testing — reads from a JSON file |
| OS Keyring | `keyring` | Local development — uses OS credential manager |
| Azure Key Vault | `azure-keyvault` | Production on Azure — resolves from Key Vault |

For full provider configuration details, see [Configure Secret Stores]({{< relref "configure-secret-stores" >}}).

{{% alert title="Bootstrap constraint" color="info" %}}
The `secretStore` configuration itself cannot use secret references (circular dependency). Use literal values or environment variables for the secret store's own fields.
{{% /alert %}}

## Performance Tuning

These settings control queue/buffer sizing in DrasiLib. They are most useful for high-throughput workloads or when you want to set consistent defaults across multiple queries/sources.
Expand Down Expand Up @@ -547,6 +592,10 @@ DB_PASSWORD=secret123

For production, set environment variables through your deployment platform (Docker, systemd, etc.).

{{% alert title="Tip: Secret stores" color="info" %}}
For stronger secret management, consider using a [secret store]({{< relref "configure-secret-stores" >}}) instead of (or alongside) environment variables. Secret stores keep credentials in a dedicated vault and prevent them from appearing in environment variable dumps or process listings.
{{% /alert %}}

### Separating Concerns with Multiple Config Files

For complex deployments, consider organizing configs by environment:
Expand Down
Loading
Loading