Set application secrets

[itsameandrea]

Is it possible at the moment (or will it be possible at some point) to set application-level secrets? It would be cool to have a terraform-based alternative to running

flyctl secrets set foo=bar -a XXXXXXX

[DAlperin]

Hmm yeah. Hadn't considered but yeah, totally doable. Will add this week.

[itsameandrea]

Amazing stuff. Thank you so much @DAlperin!

[DAlperin]

@ilrock out of curiosity how do you currently manage secrets in terraform. Do you use a secrets.tfvar file or some such or do you integrate with a secret service?

[itsameandrea]

Hey @DAlperin! Sorry just seen this. Either way - at the moment I'm prepending my secrets with TF_VAR_

[StarpTech]

Hi, what's the status? Would love to configure secrets as well.

[DAlperin]

@StarpTech coming soon! I've had some health problems, so my work has been limited. But this is definitely coming.

[StarpTech]

Thanks for the update. Get well soon!

[divmgl]

Any update on this? Just ran into this and the only real alternative is to use some kind of vault and then connect to it using an initial secret.

[alexnitta]

I would also love to use this feature. At the moment, I have to do some unsavory workarounds to make sure that secrets exist before I use terraform apply to create a machine that relies on them.

[DAlperin]

Yeah, I'll take another crack at this later this week. Sorry for the delay. Been crazy buzy.

[lukas-w]

I've written a basic implementation of a fly_secret resource that may help at https://github.com/lukas-w/terraform-provider-fly/blob/f-secrets/internal/provider/secret_resource.go.

resource "fly_secret" "my_app_secret" {
  app = fly_app.my_app.id
  name = "SECRET_PASSWORD"
  value = "top-secret-value"
}

[lukas-w]

Turns out that's not a good solution with non-machine apps because it'll trigger a new release & deploy for every single secret. Implemented instead as secrets attribute of fly_app in PR #106.

[alexnitta]

@DAlperin it would be great if you happen to have any time to look at this.