Secrets

write-only · the agent runs secret run NAME -- cmd
{#if !enabled}

Secrets are off: SECRETS_KEY is not set.

Put a key in the gateway's environment (openssl rand -hex 32) and recreate the container. Existing names stay listed; values cannot be set or read until then.

{/if} {#if failure} load()} /> {:else if secrets === null}

Loading…

{:else if secrets.length === 0} {#if enabled} {/if} {:else}
{#each secrets as row (row.name)} {/each}
name
{row.name}
{#if row.description} {row.description} {/if} {row.filename ? `${row.filename} · ${fmtBytes(row.size)}` : "value"} · changed {fmtRelative(row.updated_at)} · {row.used_at ? `used ${fmtRelative(row.used_at)}` : "never used"}
{/if}
{editing ? `Replace ${editing.name}` : "New secret"} {editing ? "Leave the value empty to change only the description." : "Stored encrypted. After saving, the value is not shown anywhere."}
{ event.preventDefault(); save(); }} > {#if !editing}
{ secretName = secretName.toUpperCase().replaceAll(/[\s-]/g, "_"); }} placeholder="NODEREAL_BSC" required spellcheck={false} bind:value={secretName} />

{nameError ?? `The command reads it as $${secretName || "NAME"}.`}

{/if}
Value File

One line. Multi-line keys and JSON go in as a file.

{fileError ?? "Up to 1 MB. The command gets $NAME as the path to a private copy, removed when it exits."}

{ if (!open) { doomed = null; } }} open={doomed !== null} > Delete {doomed?.name}? Commands that ask for it will fail with “unknown secret”. The value cannot be recovered.